PT-2026-7167 · Unknown · Filebrowser

Dogadmin · Published 2026-02-09 · Updated 2026-03-03 · CVE-2026-25889

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.57.1

Description File Browser offers a file management interface for tasks like uploading, deleting, previewing, renaming, and editing files. A flaw in the password validation process, specifically a case-sensitivity issue, allows authenticated users to modify their passwords—or, for administrators, any user's password—without providing the current password. This bypass occurs when the 'Password' field is capitalized in the API request instead of using lowercase 'password', effectively circumventing the current password verification. Successful exploitation, potentially through methods like cross-site scripting (XSS) or session hijacking to obtain a valid JSON Web Token (JWT), can lead to account takeover. The vulnerable parameter is password. The affected API endpoint is not explicitly mentioned.

Recommendations Update to version 2.57.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2026-25889

GHSA-HXW8-4H9J-HQ2R

GO-2026-4475

SUSE-SU-2026:0757-1

Affected Products

Filebrowser

References · 122

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25889.json · Exploit
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hxw8-4h9j-hq2r · Vendor Advisory
• https://github.com/filebrowser/filebrowser/commit/ff2f00498cff151e2fb1f5f0b16963bf33c3d6d4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25889 · Security Note
• https://osv.dev/vulnerability/GHSA-hxw8-4h9j-hq2r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4475 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25889 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1 · Note
• https://suse.com/security/cve/CVE-2025-65852 · Note
• https://suse.com/security/cve/CVE-2026-21435 · Note
• https://suse.com/security/cve/CVE-2026-27587 · Note
• https://reddit.com/r/VulnMatter/comments/1r1174e/resumen_diario_de_vulnerabilidades_10022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post