Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | Disclosure1 |
| 2026-02-10 | 2 | Disclosure2 |
CVE-2026-25889 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a … https://www.cve.org/CVERecord?id=CVE-2026-25889
Post summary
The text announces CVE‑2026‑25889 for File Browser, noting that versions prior to 2.57.1 allow various file operations. No additional exploitation details, patches, or PoCs are provided.
CVE-2026-25889 Authentication Bypass in File Browser Before 2.57.1 via Case-Sensitive P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25889 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
CVE-2026-25889 is an authentication bypass in File Browser versions prior to 2.57.1 caused by case‑sensitive handling. No exploit or patch information is provided in the brief announcement.
CVE-2026-25889: Case Sensitive, Security Insensitive: Bypassing Auth in File Browser File Browser, the beloved Swiss Army knife for self-hosted file management, suffered from a classic logic error: it forgot that 'Password' and 'password' are not the ... https://cvereports.com/reports/CVE-2026-25889
Post summary
The report reveals a case‑sensitive authentication bypass in File Browser (CVE‑2026‑25889), but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | filebrowser | filebrowser | - | - | - |