CVE-2026-25890: File Browser Auth Bypass Vulnerability

CVE-2026-25890 Overview

CVE-2026-25890 is an Authorization Bypass vulnerability in File Browser, a web-based file management interface that allows users to upload, delete, preview, rename, and edit files within a specified directory. Prior to version 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by manipulating the request URL with multiple slashes. This path normalization inconsistency allows unauthorized access to restricted files and directories.

Critical Impact
Authenticated attackers can bypass file access restrictions to read or modify sensitive files that should be protected by the application's "Disallow" rules, potentially leading to data theft or unauthorized modifications.

Affected Products

File Browser versions prior to 2.57.1

Discovery Timeline

2026-02-09 - CVE-2026-25890 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25890

Vulnerability Analysis

This vulnerability is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference), where the application's authorization mechanism and the underlying filesystem handle path normalization differently. When an authenticated user submits a request with multiple slashes in the URL path (e.g., //private/ instead of /private/), the authorization check fails to match the configured "Disallow" rules. However, the filesystem correctly resolves the path, granting the user access to files that should be restricted.

The root cause lies in the use of SkipClean(true) in the Gorilla Mux router configuration, which was originally implemented to handle trailing slash redirects. This setting prevented the router from normalizing paths before passing them to the application's authorization handlers.

Root Cause

The vulnerability stems from a path handling inconsistency where the HTTP router was configured with SkipClean(true), allowing non-normalized paths (containing multiple consecutive slashes) to bypass the authorization logic while still resolving correctly at the filesystem level. This created a security gap between the authorization check and the actual file access.

Attack Vector

This is a network-based attack requiring low privileges (authenticated user) with no user interaction needed. An attacker with valid credentials can:

Identify restricted paths configured in the "Disallow" rules
Craft malicious requests by inserting multiple slashes in the path
Bypass authorization checks to access restricted files
Read sensitive data or potentially modify files depending on permissions

The security patch removes the SkipClean(true) configuration, ensuring paths are properly normalized before authorization checks:

 	})
 	index, static := getStaticHandlers(store, server, assetsFs)
 
-	// NOTE: This fixes the issue where it would redirect if people did not put a
-	// trailing slash in the end. I hate this decision since this allows some awful
-	// URLs https://www.gorillatoolkit.org/pkg/mux#Router.SkipClean
-	r = r.SkipClean(true)
-
 	monkey := func(fn handleFunc, prefix string) http.Handler {
 		return handle(fn, prefix, store, server)
 	}

Source: GitHub Commit Update

Detection Methods for CVE-2026-25890

Indicators of Compromise

HTTP request logs showing unusual path patterns with multiple consecutive slashes (e.g., //, ///)
Access to files or directories that should be restricted by "Disallow" rules
Authenticated users accessing paths outside their permitted scope
Web server logs with URL patterns containing path normalization anomalies

Detection Strategies

Monitor web application logs for requests containing multiple consecutive slashes in file paths
Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts
Review File Browser access logs for access to paths matching "Disallow" configurations
Set up alerts for authenticated users accessing files outside expected directories

Monitoring Recommendations

Enable detailed access logging in File Browser to track all file operations
Deploy intrusion detection systems with rules for path manipulation attacks
Regularly audit "Disallow" rule configurations to ensure proper coverage
Monitor for unusual file access patterns from authenticated user accounts

How to Mitigate CVE-2026-25890

Immediate Actions Required

Upgrade File Browser to version 2.57.1 or later immediately
Review access logs for any signs of exploitation prior to patching
Audit "Disallow" rules and verify their effectiveness after the upgrade
Consider temporarily restricting File Browser access until patching is complete

Patch Information

The vulnerability is fixed in File Browser version 2.57.1. The fix removes the SkipClean(true) router configuration, ensuring that all paths are properly normalized before authorization checks are performed. Organizations should upgrade to version 2.57.1 or later as documented in the GitHub Release v2.57.1.

For additional technical details, refer to the GitHub Security Advisory GHSA-4mh3-h929-w968.

Workarounds

If immediate upgrade is not possible, consider placing File Browser behind a reverse proxy that normalizes paths before forwarding requests
Implement additional WAF rules to block requests containing multiple consecutive slashes
Restrict network access to File Browser to trusted IP ranges only
Review and strengthen "Disallow" rules to use pattern matching that accounts for path variations

bash

# Example nginx configuration to normalize paths before forwarding to File Browser
location / {
    # Normalize multiple slashes in the URL path
    if ($request_uri ~ "^[^?]*?//") {
        rewrite ^(.*)$ $uri permanent;
    }
    proxy_pass http://filebrowser:8080;
}