CVE-2026-25890
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Feb 9, 2026
CISA due date
—
The record
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/filebrowser/filebrowser | 0 | No fix |
| Go | github.com/filebrowser/filebrowser/v2 | 0 | 2.57.1 |
| Chainguard | filebrowser | 0 | 2.59.0-r0 |
| Chainguard | filebrowser-compat | 0 | 2.59.0-r0 |
| Wolfi | filebrowser | 0 | 2.59.0-r0 |
| Wolfi | filebrowser-compat | 0 | 2.59.0-r0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4474 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL… Same vulnerability
- GO-2026-4475 File Browser has an Authentication Bypass in User Password Update in… Also affects github.com/filebrowser/filebrowser
- CVE-2026-25889 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser
- CVE-2026-23849 File Browser provides a file managing interface within a specified directory and can be… Also affects github.com/filebrowser/filebrowser
- GO-2025-4117 File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion… Also affects github.com/filebrowser/filebrowser
- GO-2025-4118 File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in… Also affects github.com/filebrowser/filebrowser
- CVE-2025-64523 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser
- CVE-2025-58058 xz is a pure golang package for reading and writing xz-compressed files. Also affects filebrowser