CVE-2026-25889 Details
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.
A vulnerability in File Browser prior to version 2.57.1 allows authenticated users to change passwords without providing the current password. This issue arises from a case-sensitivity flaw in the password validation process. By using the Title Case 'Password' instead of the lowercase 'password' in API requests, the requirement to verify the current password is completely bypassed. As a result, an attacker who obtains a valid JWT token through methods such as cross-site scripting or session hijacking can exploit this flaw for account takeover.
Users can update to File Browser version 2.57.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/commit/ff2f00498cff151e2fb1f5f0b16963bf33c3d6d4 | [email protected] | Patch |
| https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1 | [email protected] | ProductRelease Notes |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hxw8-4h9j-hq2r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filebrowser filebrowser | < 2.57.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 23, 2026 | Initial Analysis | [email protected] |
| Feb 9, 2026 | New CVE Received | [email protected] |