PT-2026-7168 · Unknown · Filebrowser

Fluxmux · Published 2026-02-09 · Updated 2026-03-03 · CVE-2026-25890

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.57.1

Description File Browser offers a file management interface for tasks like uploading, deleting, previewing, renaming, and editing files within a designated directory. Before version 2.57.1, an authenticated user could circumvent the application's file path restrictions by manipulating the request URL. Specifically, adding multiple slashes (e.g., //private/) to the path causes the authorization check to fail, while the filesystem correctly resolves the path, potentially granting unauthorized access to restricted files. The vulnerability involves bypassing the application’s “Disallow” file path rules.

Recommendations Update to File Browser version 2.57.1 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-706

CWE-863

Related Identifiers

CVE-2026-25890

GHSA-4MH3-H929-W968

GO-2026-4474

SUSE-SU-2026:0757-1

Affected Products

Filebrowser

References · 122

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25890.json · Exploit
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9 · Patch
• https://osv.dev/vulnerability/GHSA-4mh3-h929-w968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25890 · Security Note
• https://osv.dev/vulnerability/GO-2026-4474 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25890 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1 · Note
• https://suse.com/security/cve/CVE-2025-65852 · Note
• https://suse.com/security/cve/CVE-2026-21435 · Note
• https://suse.com/security/cve/CVE-2026-27587 · Note
• https://reddit.com/r/VulnMatter/comments/1r1174e/resumen_diario_de_vulnerabilidades_10022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post