CVE-2026-25890: File Browser Auth Bypass Vulnerability

CVE-2026-25890 Overview

CVE-2026-25890 is an Authorization Bypass vulnerability in File Browser, a web-based file management interface that allows users to upload, delete, preview, rename, and edit files within a specified directory. Prior to version 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by manipulating the request URL with multiple slashes. This path normalization inconsistency allows unauthorized access to restricted files and directories.

Critical Impact

Authenticated attackers can bypass file access restrictions to read or modify sensitive files that should be protected by the application's "Disallow" rules, potentially leading to data theft or unauthorized modifications.

Affected Products

• File Browser versions prior to 2.57.1

Discovery Timeline

• 2026-02-09 - CVE-2026-25890 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25890

Vulnerability Analysis

This vulnerability is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference), where the application's authorization mechanism and the underlying filesystem handle path normalization differently. When an authenticated user submits a request with multiple slashes in the URL path (e.g., //private/ instead of /private/), the authorization check fails to match the configured "Disallow" rules. However, the filesystem correctly resolves the path, granting the user access to files that should be restricted.

The root cause lies in the use of SkipClean(true) in the Gorilla Mux router configuration, which was originally implemented to handle trailing slash redirects. This setting prevented the router from normalizing paths before passing them to the application's authorization handlers.

Root Cause

The vulnerability stems from a path handling inconsistency where the HTTP router was configured with SkipClean(true), allowing non-normalized paths (containing multiple consecutive slashes) to bypass the authorization logic while still resolving correctly at the filesystem level. This created a security gap between the authorization check and the actual file access.

Attack Vector

This is a network-based attack requiring low privileges (authenticated user) with no user interaction needed. An attacker with valid credentials can:

1. Identify restricted paths configured in the "Disallow" rules
2. Craft malicious requests by inserting multiple slashes in the path
3. Bypass authorization checks to access restricted files
4. Read sensitive data or potentially modify files depending on permissions

The security patch removes the SkipClean(true) configuration, ensuring paths are properly normalized before authorization checks:

 	})
 	index, static := getStaticHandlers(store, server, assetsFs)
 
-	// NOTE: This fixes the issue where it would redirect if people did not put a
-	// trailing slash in the end. I hate this decision since this allows some awful
-	// URLs https://www.gorillatoolkit.org/pkg/mux#Router.SkipClean
-	r = r.SkipClean(true)
-
 	monkey := func(fn handleFunc, prefix string) http.Handler {
 		return handle(fn, prefix, store, server)
 	}

Source: GitHub Commit Update

Detection Methods for CVE-2026-25890

Indicators of Compromise

• HTTP request logs showing unusual path patterns with multiple consecutive slashes (e.g., //, ///)
• Access to files or directories that should be restricted by "Disallow" rules
• Authenticated users accessing paths outside their permitted scope
• Web server logs with URL patterns containing path normalization anomalies

Detection Strategies

• Monitor web application logs for requests containing multiple consecutive slashes in file paths
• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts
• Review File Browser access logs for access to paths matching "Disallow" configurations
• Set up alerts for authenticated users accessing files outside expected directories

Monitoring Recommendations

• Enable detailed access logging in File Browser to track all file operations
• Deploy intrusion detection systems with rules for path manipulation attacks
• Regularly audit "Disallow" rule configurations to ensure proper coverage
• Monitor for unusual file access patterns from authenticated user accounts

How to Mitigate CVE-2026-25890

Immediate Actions Required

• Upgrade File Browser to version 2.57.1 or later immediately
• Review access logs for any signs of exploitation prior to patching
• Audit "Disallow" rules and verify their effectiveness after the upgrade
• Consider temporarily restricting File Browser access until patching is complete

Patch Information

The vulnerability is fixed in File Browser version 2.57.1. The fix removes the SkipClean(true) router configuration, ensuring that all paths are properly normalized before authorization checks are performed. Organizations should upgrade to version 2.57.1 or later as documented in the GitHub Release v2.57.1.

For additional technical details, refer to the GitHub Security Advisory GHSA-4mh3-h929-w968.

Workarounds

• If immediate upgrade is not possible, consider placing File Browser behind a reverse proxy that normalizes paths before forwarding requests
• Implement additional WAF rules to block requests containing multiple consecutive slashes
• Restrict network access to File Browser to trusted IP ranges only
• Review and strengthen "Disallow" rules to use pattern matching that accounts for path variations

# Example nginx configuration to normalize paths before forwarding to File Browser
location / {
    # Normalize multiple slashes in the URL path
    if ($request_uri ~ "^[^?]*?//") {
        rewrite ^(.*)$ $uri permanent;
    }
    proxy_pass http://filebrowser:8080;
}