CVE-2026-25890
Path Traversal in File Browser Allows Unauthorized File Access
Publication date: 2026-02-09
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | to 2.57.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in File Browser versions prior to 2.57.1. It allows an authenticated user to bypass the application's "Disallow" file path rules by modifying the request URL. Specifically, by adding multiple slashes (for example, //private/) to the path, the authorization check fails to correctly match the restriction rules. However, the underlying filesystem still resolves the path correctly, which results in unauthorized access to restricted files.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to restricted files within the File Browser application. Since an authenticated user can bypass file path restrictions, sensitive or private files that should be protected may be accessed, viewed, or potentially modified. This can compromise confidentiality and integrity of data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade File Browser to version 2.57.1 or later, where the issue has been fixed.