CVE-2026-25889: File Browser Auth Bypass Vulnerability

CVE-2026-25889 Overview

CVE-2026-25889 is an authentication bypass vulnerability in File Browser, a web-based file management interface that allows users to upload, delete, preview, rename, and edit files within a specified directory. The vulnerability exists in versions prior to 2.57.1 and stems from a case-sensitivity flaw in the password validation logic.

This flaw allows any authenticated user to change their password (or an administrator to change any user's password) without providing the current password. By using a Title Case field name "Password" instead of the expected lowercase "password" in the API request, the current_password verification is completely bypassed.

Critical Impact

This vulnerability enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. An authenticated attacker can bypass password verification entirely, potentially compromising all user accounts on vulnerable File Browser instances.

Affected Products

• File Browser versions prior to 2.57.1
• All platforms running vulnerable File Browser instances
• Self-hosted File Browser deployments with user authentication enabled

Discovery Timeline

• February 9, 2026 - CVE-2026-25889 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25889

Vulnerability Analysis

This authentication bypass vulnerability (CWE-178: Improper Handling of Case Sensitivity) occurs due to inconsistent case handling in the password change API endpoint. The File Browser application expects password-related fields to be submitted in lowercase format. However, the validation logic fails to properly normalize or compare field names in a case-insensitive manner.

When processing password change requests, the backend code checks for the presence of a "password" field to determine if current password verification is required. By sending the field as "Password" (with a capital P), an attacker can bypass this check entirely because the case-sensitive comparison fails to match the expected lowercase field name.

The attack requires valid authentication (a JWT token), which can be obtained through various means including XSS attacks, session hijacking, or social engineering. Once authentication is obtained, the attacker can change the password of any account they have permission to modify without knowing the current password.

Root Cause

The root cause is improper handling of case sensitivity in API request field validation within the http/users.go file. The password change endpoint performs case-sensitive string comparisons on JSON field names, allowing attackers to bypass validation by simply altering the capitalization of the password field to Password.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated user). An attacker who has obtained a valid JWT token can craft a malicious API request to the password change endpoint, substituting "Password" for "password" in the request body. This bypasses the current password verification, allowing the attacker to set a new password without knowledge of the existing one.

 	"net/http"
 	"sort"
 	"strconv"
+	"strings"

 	"github.com/gorilla/mux"
 	"golang.org/x/text/cases"

Source: GitHub Commit Update

The patch adds the strings package import, which is used to normalize field name capitalization before validation, ensuring case-insensitive comparison of password-related fields.

Detection Methods for CVE-2026-25889

Indicators of Compromise

• Unexpected password change events in File Browser logs without corresponding legitimate user activity
• API requests to user modification endpoints containing non-standard field capitalization (e.g., "Password" instead of "password")
• Multiple failed authentication attempts followed by successful logins after suspicious password change activity
• JWT tokens being used from unusual IP addresses or geographic locations

Detection Strategies

• Monitor File Browser API logs for password change requests with non-lowercase field names in JSON payloads
• Implement alerting on user account modifications that occur without proper authentication flow
• Enable and review audit logs for all user management operations
• Deploy web application firewalls (WAF) with rules to detect case manipulation in sensitive API fields

Monitoring Recommendations

• Enable verbose logging for all authentication and user management endpoints in File Browser
• Configure SIEM rules to correlate password change events with prior authentication activities
• Monitor for unusual patterns in JWT token usage across different IP addresses
• Regularly audit user accounts for unauthorized password changes or privilege modifications

How to Mitigate CVE-2026-25889

Immediate Actions Required

• Upgrade File Browser to version 2.57.1 or later immediately
• Review audit logs for any suspicious password change activity prior to patching
• Force password resets for all user accounts if compromise is suspected
• Revoke and regenerate all active JWT tokens after applying the patch
• Implement additional authentication controls such as multi-factor authentication if available

Patch Information

The vulnerability has been fixed in File Browser version 2.57.1. The patch normalizes field name capitalization in the http/users.go file before performing validation, ensuring that password-related field comparisons are case-insensitive.

For detailed information about the fix, refer to:

• GitHub Security Advisory GHSA-hxw8-4h9j-hq2r
• GitHub Release v2.57.1
• GitHub Commit ff2f00498cff151e2fb1f5f0b16963bf33c3d6d4

Workarounds

• Restrict network access to File Browser instances to trusted networks only until patching is complete
• Implement reverse proxy rules to reject API requests with non-standard capitalization in sensitive fields
• Disable user self-service password changes if operationally feasible
• Monitor and rate-limit API calls to user management endpoints

# Example: Restrict File Browser access to internal network via firewall
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP