CVE-2026-25889

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.

• CWE-178

• https://github.com/filebrowser/filebrowser/commit/ff2f00498cff151e2fb1f5f0b16963bf33c3d6d4Patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1Product, Release Notes
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hxw8-4h9j-hq2rExploit, Mitigation, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25882Fiber is an Express inspired web framework written in Go. A …7.5
• CVE-2026-25883Vexa is an open-source, self-hostable meeting bot API and me…5.8
• CVE-2026-25884Exiv2 is a C++ library and a command-line utility to read, w…8.1
• CVE-2026-25885PolarLearn is a free and open-source learning program. In 0-…7.5
• CVE-2026-25887Chartbrew is an open-source web application that can connect…7.2
• CVE-2026-25888Chartbrew is an open-source web application that can connect…8.8
• CVE-2026-2589The Greenshift – animation and page builder blocks plugin fo…5.3
• CVE-2026-25890File Browser provides a file managing interface within a spe…8.1
• CVE-2026-25891Fiber is an Express inspired web framework written in Go. A …7.5
• CVE-2026-25892Adminer is open-source database management software. Adminer…7.5
• CVE-2026-25893FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25894FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8