https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:51:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-25889 <p><strong>Affected:</strong> filebrowser</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user&#39;s password) without providing the current password. By using Title Case field name &#34;Password&#34; instead of lowercase &#34;password&#34; in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.</p> <p><strong>Affected:</strong> filebrowser</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user&#39;s password) without providing the current password. By using Title Case field name &#34;Password&#34; instead of lowercase &#34;password&#34; in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-25889