CVE-2026-25889 — Improper Handling of Case Sensitivity in Filebrowser
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 97.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 9
Latest updateFeb 17
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completel…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5
Affected Packages3 packages
Patches
🔴Vulnerability Details
4OSV▶
File Browser has an Authentication Bypass in User Password Update in github.com/filebrowser/filebrowser↗2026-02-17