CVE-2026-25890: 
NixOS vulnerability analysis and mitigation

CVE-2026-25890 is a path-based access control bypass vulnerability in File Browser, a web-based file management interface, that allows authenticated users to circumvent administrator-defined "Disallow" file path rules by prepending multiple slashes to request URLs. All versions up to and including 2.57.0 are affected; the vulnerability was fixed in version 2.57.1. The advisory was published on February 8, 2026, by maintainer hacdias, and assigned a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Security Advisory).

The root cause lies in two interacting design decisions classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference) and CWE-863 (Incorrect Authorization). First, the HTTP router in http/http.go was configured with r.SkipClean(true), which disabled automatic normalization of multiple consecutive slashes in URL paths before they reached request handlers. Second, the rule enforcement logic in rules/rules.go used a simple strings.HasPrefix(path, r.Path) check — meaning a "Disallow" rule for /private would not match a request path of //private because the string prefix comparison fails. The underlying filesystem, however, treats multiple slashes as a single separator and correctly resolves //private/secret.txt, effectively serving the restricted file. The fix (commit 489af40) removes the r.SkipClean(true) call, restoring automatic path normalization before rule matching (Security Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to read files they are explicitly forbidden from accessing (high confidentiality impact) and, if they hold general write permissions, to rename, delete, or modify files in restricted directories (high integrity impact). Availability is not directly affected. The scope of impact is limited to files within the File Browser's configured directory, but sensitive data exposure and unauthorized file modification could have significant downstream consequences depending on what is stored and managed through the application (GitHub Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub at mbanyamer/CVE-2026-25890-FileBrowser-Access-Control-Bypass, and the official security advisory itself includes a minimal Python PoC demonstrating the bypass (Security Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.027% (3rd percentile), indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Obtain valid credentials for any low-privileged user account on the target File Browser instance (version ≤ 2.57.0).
2. Identify restricted paths: Browse the application as a normal user to identify directories returning 403 Forbidden, indicating an active "Disallow" rule (e.g., /private).
3. Craft bypass request: Modify the API request URL by prepending an extra slash to the restricted path. For example, change GET /api/resources/private/secret.txt to GET /api/resources//private/secret.txt.
4. Send the request: Issue the crafted HTTP GET request using a browser, curl, or a scripted tool (e.g., Python requests library). The authorization check fails to match the "Disallow" rule because //private does not pass the strings.HasPrefix check for /private.
5. Access restricted content: The server responds with 200 OK and returns the file contents, as the filesystem resolves //private/secret.txt correctly.
6. Perform write operations (if applicable): If the user has general write permissions, issue PUT, PATCH, or DELETE requests using the same double-slash path prefix to modify or delete files in the restricted directory (Security Advisory).

• Network: HTTP GET/PUT/DELETE requests to the File Browser API containing paths with multiple consecutive leading slashes (e.g., /api/resources//private/, /api/resources///confidential/); successful 200 OK responses to such requests from accounts that should receive 403 Forbidden.
• Logs: Web server or application access logs showing requests with double or triple slashes in the path (e.g., GET /api/resources//private/secret.txt HTTP/1.1" 200); repeated access attempts to restricted paths from a single authenticated user account.
• File System: Unexpected access, modification, or deletion timestamps on files within administrator-restricted directories; audit logs showing file reads or writes by users who should not have access to those directories.

The vendor has released File Browser version 2.57.1, which resolves the vulnerability by removing the r.SkipClean(true) router configuration, restoring automatic URL path normalization before authorization checks are applied (Release v2.57.1, Fix Commit). All users running version 2.57.0 or earlier should upgrade to 2.57.1 immediately. If immediate patching is not possible, restrict File Browser network access to trusted networks only using firewall rules or a reverse proxy, and monitor access logs for requests containing multiple consecutive slashes in the path.

The vulnerability was noted by security aggregators including The Hacker Wire on Mastodon and Bluesky shortly after disclosure. Coverage appeared on CVE tracking platforms such as cvefeed.io, vulners.com, and cvereports.com. No significant vendor statements beyond the official GitHub advisory, nor notable independent researcher commentary, have been identified.