CVE-2026-25890
📋 TL;DR
In File Browser versions before 2.57.1, authenticated users can bypass file access restrictions by adding extra slashes to file paths in requests. This allows unauthorized access to files that should be blocked by 'Disallow' rules. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- File Browser
📦 What is this software?
Filebrowser by Filebrowser
⚠️ Risk & Real-World Impact
Worst Case
Authenticated users access sensitive system files, configuration files, or other restricted data, potentially leading to data theft, privilege escalation, or system compromise.
Likely Case
Users access files outside their intended directory scope, violating data segregation policies and potentially exposing confidential information.
If Mitigated
With proper network segmentation and minimal user privileges, impact is limited to the specific File Browser instance and its accessible files.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of restricted file paths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.57.1
Vendor Advisory: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968
Restart Required: Yes
Instructions:
1. Stop File Browser service. 2. Backup configuration and data. 3. Update to version 2.57.1 or later. 4. Restart File Browser service.
🔧 Temporary Workarounds
Path Normalization Filter
allImplement middleware or proxy to normalize paths by removing duplicate slashes before reaching File Browser.
🧯 If You Can't Patch
- Restrict authenticated user permissions to minimum necessary
- Implement network-level access controls to limit File Browser's reach to sensitive directories
🔍 How to Verify
Check if Vulnerable:
Check File Browser version; if below 2.57.1 and 'Disallow' rules are configured, system is vulnerable.Check Version:
filebrowser versionVerify Fix Applied:
After updating to 2.57.1+, test that paths with duplicate slashes are properly blocked by 'Disallow' rules.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '//' or multiple slashes in file paths
- Access to files outside configured directories
Network Indicators:
- Unusual file access patterns from authenticated users
SIEM Query:
source="filebrowser" AND (url="*//*" OR path="*//*")