CVE-2026-25890

Undergoing Analysis Undergoing Analysis - In Progress

Path Traversal in File Browser Allows Unauthorized File Access

Publication date: 2026-02-09

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-09

Last Modified

2026-02-20

Generated

2026-07-06

AI Q&A

2026-02-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25890

EUVD

EUVD-2026-6866

Affected Vendors & Products

Vendor	Product	Version / Range
filebrowser	filebrowser	to 2.57.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in File Browser versions prior to 2.57.1. It allows an authenticated user to bypass the application's "Disallow" file path rules by modifying the request URL. Specifically, by adding multiple slashes (for example, //private/) to the path, the authorization check fails to correctly match the restriction rules. However, the underlying filesystem still resolves the path correctly, which results in unauthorized access to restricted files.

Impact Analysis

The vulnerability can lead to unauthorized access to restricted files within the File Browser application. Since an authenticated user can bypass file path restrictions, sensitive or private files that should be protected may be accessed, viewed, or potentially modified. This can compromise confidentiality and integrity of data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade File Browser to version 2.57.1 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-25890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70