CVE-2026-25889

The record

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.

Affected packages

Related vulnerabilities

• GO-2026-4475 File Browser has an Authentication Bypass in User Password Update in… Same vulnerability
• GO-2026-4474 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL… Also affects github.com/filebrowser/filebrowser
• CVE-2026-25890 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser
• CVE-2026-23849 File Browser provides a file managing interface within a specified directory and can be… Also affects github.com/filebrowser/filebrowser
• GO-2025-4117 File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion… Also affects github.com/filebrowser/filebrowser
• GO-2025-4118 File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in… Also affects github.com/filebrowser/filebrowser
• CVE-2025-64523 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb