Detections
Analytics

SCA: security update for github.com/filebrowser/filebrowser/v2 (GHSA-hxw8-4h9j-hq2r)

medium Tenable Cloud Security Plugin ID 437669

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - File Browser provides a file managing interface within a specified directory and it can be used to upload,
 delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password
 validation logic allows any authenticated user to change their password (or an admin to change any user's
 password) without providing the current password. By using Title Case field name "Password" instead of
 lowercase "password" in the API request, the current_password verification is completely bypassed. This
 enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other
 means. This vulnerability is fixed in 2.57.1. (CVE-2026-25889)

See Also

https://github.com/advisories/GHSA-hxw8-4h9j-hq2r

Plugin Details

Severity: Medium

ID: 437669

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 2/10/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.71

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-25889

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/10/2026

Vulnerability Publication Date: 2/9/2026

Reference Information

CVE: CVE-2026-25889

cwe: CWE-178