GO-2026-4474
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL in github.com/filebrowser/filebrowser
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/filebrowser/filebrowser | 0 | No fix |
| Go | github.com/filebrowser/filebrowser/v2 | 0 | 2.57.1 |
Related vulnerabilities
- CVE-2026-25890 File Browser provides a file managing interface within a specified directory and it can… Same vulnerability
- GO-2026-4475 File Browser has an Authentication Bypass in User Password Update in… Also affects github.com/filebrowser/filebrowser
- CVE-2026-25889 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser
- CVE-2026-23849 File Browser provides a file managing interface within a specified directory and can be… Also affects github.com/filebrowser/filebrowser
- GO-2025-4117 File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion… Also affects github.com/filebrowser/filebrowser
- GO-2025-4118 File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in… Also affects github.com/filebrowser/filebrowser
- CVE-2025-64523 File Browser provides a file managing interface within a specified directory and it can… Also affects github.com/filebrowser/filebrowser