File Browser allows directory-based file management and includes functionality for uploading, deleting, previewing, renaming, and editing files. A case‑sensitivity flaw in the password validation logic permits any authenticated user to change their own password or an administrator to change any user’s password without providing the current password. By sending a request field named "Password" instead of the required lowercase "password", the current_password check is bypassed, enabling an attacker who already holds a valid JWT token to take over an account. This results in unauthorized access to file system content, potential data exposure, or further internal compromise.

The vulnerability affects instances of File Browser supplied by the vendor filebrowser, currently version 2.57.1 is the first release with the fix. All earlier releases prior to 2.57.1 are vulnerable.

The CVSS score of 5.4 indicates medium severity, while the EPSS score is less than 1%, implying a low but non‑zero probability of exploitation at the time of analysis. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires the attacker to possess a valid JWT token, which could be obtained via XSS, session hijacking, or other means. Once a token is in hand, the bypass is straightforward, providing full password reset capability and effectively account takeover.