CVE-2026-25890

🗓️ 09 Feb 2026 21:21:50Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 31 Views🌐 WEB

File Browser path bypass with multiple slashes lets authenticated users access restricted files before 2.57.1; fixed in 2.57.1.

Reporter	Title	Published	Views	Family All 111
GithubExploit	Exploit for CVE-2026-25890	19 Feb 202621:20	–	githubexploit
ATTACKERKB	CVE-2026-25890	9 Feb 202621:21	–	attackerkb
Chainguard	CVE-2026-25890 vulnerabilities	15 Feb 202619:17	–	cgr
Circl	CVE-2026-25890	8 Feb 202612:21	–	circl
CNNVD	File Browser 安全漏洞	9 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-25890 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL	9 Feb 202621:21	–	cvelist
Github Security Blog	File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL	10 Feb 202600:25	–	github
NVD	CVE-2026-25890	9 Feb 202622:16	–	nvd
OSV	CGA-PJF5-J5Q9-F763	15 Feb 202617:30	–	osv
OSV	CVE-2026-25890 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL	9 Feb 202621:21	–	osv

NVD

Vulners

Node

filebrowser filebrowserRange<2.57.1

[
  {
    "vendor": "filebrowser",
    "product": "filebrowser",
    "versions": [
      {
        "version": "< 2.57.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/filebrowser/filebrowser/releases/tag/v2.57.1
github	www.github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968
github	www.github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9

Parameter	Position	Path	Description	CWE
path	path	/api/resources/private/secret.txt	Bypass of file path-based access control to read a restricted secret via normal and bypassed paths.	CWE-706, CWE-863
path	path	/api/resources//private/secret.txt	Bypass of file path-based access control using double leading slashes to bypass authorization checks.	CWE-706, CWE-863

17 Jun 2026 10:25Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.1

EPSS0.00461