CVE-2026-25890

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.

• CWE-706
• CWE-863
• CWE-863

• https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9Patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1Product, Release Notes
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968Exploit, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25884Exiv2 is a C++ library and a command-line utility to read, w…8.1
• CVE-2026-25885PolarLearn is a free and open-source learning program. In 0-…7.5
• CVE-2026-25887Chartbrew is an open-source web application that can connect…7.2
• CVE-2026-25888Chartbrew is an open-source web application that can connect…8.8
• CVE-2026-25889File Browser provides a file managing interface within a spe…5.4
• CVE-2026-2589The Greenshift – animation and page builder blocks plugin fo…5.3
• CVE-2026-25891Fiber is an Express inspired web framework written in Go. A …7.5
• CVE-2026-25892Adminer is open-source database management software. Adminer…7.5
• CVE-2026-25893FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25894FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25895FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25896fast-xml-parser allows users to validate XML, parse XML to J…9.3