How severe is CVE-2026-25889?

CVE-2026-25889 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-25889 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25889?

CVE-2026-25889 affects Filebrowser. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25889?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-25889 have an EU (EUVD) identifier?

Yes. CVE-2026-25889 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6865.

When was CVE-2026-25889 published?

CVE-2026-25889 was published on 2026-02-09 and last updated on 2026-06-17.

CVE-2026-25889

CVE-2026-25889 is a medium-severity vulnerability in Filebrowser with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-178.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-6865
Weakness: CWE-178
Affected product: Filebrowser
Published: 2026-02-09
Last modified: 2026-06-17

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.

Frequently asked questions

What is CVE-2026-25889?: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.
How severe is CVE-2026-25889?: CVE-2026-25889 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-25889 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25889?: CVE-2026-25889 affects Filebrowser. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25889?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-25889 have an EU (EUVD) identifier?: Yes. CVE-2026-25889 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6865.
When was CVE-2026-25889 published?: CVE-2026-25889 was published on 2026-02-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*

More vulnerabilities in Filebrowser

CVE-2026-32760 — Critical (CVSS 9.8): File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a…
CVE-2025-53826 — Critical (CVSS 9.8): File Browser provides a file managing interface within a specified directory and it can be used to upload, delete,…
CVE-2026-29188 — Critical (CVSS 9.1): File Browser provides a file managing interface within a specified directory and it can be used to upload, delete,…
CVE-2023-39612 — Critical (CVSS 9.0): A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate…
CVE-2026-30934 — High (CVSS 8.9): FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is…
CVE-2025-64523 — High (CVSS 8.8): File Browser provides a file managing interface within a specified directory and it can be used to upload, delete,…

All CVEs affecting Filebrowser →

Other CWE-178 vulnerabilities

CVE-2026-54763 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth,…
CVE-2026-40453 — Critical (CVSS 9.9): The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such…
CVE-2026-47323 — Critical (CVSS 9.8): Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative…
CVE-2024-5699 — Critical (CVSS 9.8): In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…
CVE-2023-3545 — Critical (CVSS 9.8): Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache…
CVE-2022-29604 — Critical (CVSS 9.8): An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which…

Browse all CWE-178 vulnerabilities →