CVE-2026-25890
Undergoing Analysis Undergoing Analysis - In Progress
Path Traversal in File Browser Allows Unauthorized File Access

Publication date: 2026-02-09

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25890
EUVD
EUVD-2026-6866
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.57.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in File Browser versions prior to 2.57.1. It allows an authenticated user to bypass the application's "Disallow" file path rules by modifying the request URL. Specifically, by adding multiple slashes (for example, //private/) to the path, the authorization check fails to correctly match the restriction rules. However, the underlying filesystem still resolves the path correctly, which results in unauthorized access to restricted files.

Impact Analysis

The vulnerability can lead to unauthorized access to restricted files within the File Browser application. Since an authenticated user can bypass file path restrictions, sensitive or private files that should be protected may be accessed, viewed, or potentially modified. This can compromise confidentiality and integrity of data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade File Browser to version 2.57.1 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart