Cyber Resilience

CVE-2026-25889

Filebrowser ≤ 2.57.1

Public PoC
Published
09 February 2026
Modified
23 February 2026
Patch / advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0032 25th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2026-25889 is a medium-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Filebrowser Filebrowser. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to…

more

change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-52996Same product: Filebrowser Filebrowser
CVE-2026-35605Same product: Filebrowser Filebrowser
CVE-2026-32759Same product: Filebrowser Filebrowser
CVE-2026-25890Same product: Filebrowser Filebrowser
CVE-2026-34529Same product: Filebrowser Filebrowser
CVE-2026-35585Same product: Filebrowser Filebrowser
CVE-2026-30934Same product: Filebrowser Filebrowser
CVE-2026-35606Same product: Filebrowser Filebrowser
CVE-2023-39612Same product: Filebrowser Filebrowser
CVE-2025-52902Same product: Filebrowser Filebrowser

Affected Assets

filebrowser
filebrowser
≤ 2.57.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Applying access control decisions to each request depends on accurate property determination that accounts for case differences.

Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

prevents

Application security requirements must specify case handling for identifiers and paths.

prevents

Architecture principles should enforce canonical, case-aware resource naming.

prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

degrades

Access-control rules that ignore case can allow unintended resource access.

degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References