CVE-2026-25890highCWE-706CWE-863

CVE-2026-25890: fallo de gravedad alta en filebrowser

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear filebrowser+ Monitorear github.com/filebrowser/filebrowser/v2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.5%
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
filebrowser · filebrowser
CVEs relacionadas — filebrowser

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-35585HIGHFile Browser has a Command Injection via Hook RunnerEPSS 2.0%CVE-2026-32759MEDIUMFile Browser TUS Negative Upload-Length Fires Post-Upload Hooks PrematurelyEPSS 2.0%CVE-2025-52903HIGHFile Browser Allows Execution of Shell Commands That Can Spawn Other CommandsEPSS 1.2%CVE-2025-52904HIGHFile Browser: Command Execution not Limited to ScopeEPSS 1.1%CVE-2026-54088CRITICALFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)EPSS 0.8%CVE-2026-32760CRITICALFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include AdminEPSS 0.7%