CVE-2026-25890: Github.com/filebrowser/filebrowser/v2 File Browser Has A Path-Based Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4mh3-h929-w968",
  "modified" : "2026-02-10T02:56:37Z",
  "published" : "2026-02-10T00:25:17Z",
  "aliases" : [ "CVE-2026-25890" ],
  "summary" : "File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL",
  "details" : "### Summary\nAn authenticated user can bypass the application's \"Disallow\" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.\n\n### Details\nThe vulnerability allows users to bypass \"Disallow\" rules defined by administrators.\n\nThe issue stems from how the application handles URL path normalization and rule matching:\n\n1. Router Configuration: The router in `http/http.go` is configured with `r.SkipClean(true)`. This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler.\n2. Insecure Rule Matching: The rule enforcement logic in `rules/rules.go` relies on a simple string prefix match: `strings.HasPrefix(path, r.Path)`. If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private.\n3. Filesystem Resolution: After bypassing the rule check, the non-normalized path is passed to the filesystem. The filesystem treats the multiple slashes as a single separator, successfully resolving //private/secret.txt and serving the file.\n\n### PoC\n[Python minimal PoC](https://github.com/user-attachments/files/24823114/poc.py)\n\nThe following steps demonstrate the vulnerability:\n1. Setup:\n  - Admin user creates a folder /private and adds a file /private/secret.txt.\n<img width=\"971\" height=\"719\" alt=\"Screenshot_20260123_151608\" src=\"https://github.com/user-attachments/assets/2071c92e-2bbe-46f8-a338-05b0f53d381a\" />\n<img width=\"890\" height=\"386\" alt=\"Screenshot_20260123_151551\" src=\"https://github.com/user-attachments/assets/1def540a-de26-4666-a6ab-058d5927bfbe\" />\n  - Admin adds a Disallow rule for user bob on the path /private.\n<img width=\"1005\" height=\"1126\" alt=\"Screenshot_20260123_151502\" src=\"https://github.com/user-attachments/assets/e9b57d59-f4ab-41d8-b056-8ffdaa219963\" />\n\n2. Verification:\n  - User bob requests GET /api/resources/private/secret.txt.\n  - Server responds: 403 Forbidden.\n<img width=\"1193\" height=\"721\" alt=\"Screenshot_20260123_154446\" src=\"https://github.com/user-attachments/assets/dd092a10-2f8c-4a3c-b48f-d540c483bb5a\" />\n3. Exploit:\n  - User bob requests GET /api/resources//private/secret.txt.\n  - Server responds: 200 OK (Bypass successful).\n<img width=\"1193\" height=\"721\" alt=\"Screenshot_20260123_154544\" src=\"https://github.com/user-attachments/assets/27ebb82c-f7c2-467d-ae82-f495ae3aa2d4\" />\n<img width=\"1196\" height=\"818\" alt=\"Screenshot_20260123_154618\" src=\"https://github.com/user-attachments/assets/82035884-9a24-490d-b928-7bdd2dbe3193\" />\n\n\n### Impact\nThis vulnerability impacts the confidentiality and integrity of data stored in filebrowser.\n- Confidentiality: Users can read files they are explicitly forbidden from accessing.\n- Integrity: If the user has general write permissions but is restricted from specific directories via rules, they can bypass these restrictions to rename, delete, or modify files.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/filebrowser/filebrowser/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.57.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.57.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25890"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/filebrowser/filebrowser"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-706", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-10T00:25:17Z",
    "nvd_published_at" : "2026-02-09T22:16:03Z"
  }
}