CVE-2026-25890

Katalog CVE

CVSS 8.1 · High EPSS 0,61%

Kerentanan Use of Incorrectly-Resolved Name or Reference pada filebrowser. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-706: Use of Incorrectly-Resolved Name or Reference
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968 exploit · advisory vendor
• https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9 patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1 product · release notes