CVE Breakdown

The issue is CVE-2026-25889: Authentication Bypass in User Password Update, but when you look at the source code, it almost feels like someone deliberately went out of their way to make the code vulnerable. Of course, that’s not actually what happened. if d.settings.AuthMethod == auth.MethodJSONAuth { var sensibleFields = map[string]struct{}{ "all": {}, "username": {}, "password": {}, "scope": {}, "lockPassword": {}, "commands": {}, "perm": {}, } for _, field := range req.Which { if _, ok := sensibleFields[field]; ok { if !users.CheckPwd(req.CurrentPassword, d.user.Password) { return http.StatusBadRequest, fberrors.ErrCurrentPasswordIncorrect } break } } } So, there’s a map called sensibleFields, and on each request, the Which field is checked to see whether it contains any of the listed values, such as username or password. If it does, the handler requires the current password. ...

For this blog, we’ll look at CVE-2026-34530: Stored Cross-Site Scripting via text/template branding injection and trace it back to the source code to understand exactly where and why the vulnerability exists. We have two keyword in the title: Stored Cross-Site Scripting text/template branding injection The blog assumes you at least have a basic understanding of Cross-Site Scripting. You may learn more about it at What is cross-site scripting (XSS)? We’ll come down to the second keyword: text/template branding injection ...

For this blog, we’ll look at CVE-2026-73613: Out-of-scope file deletion via symlink-following delete in TUS upload-cache eviction and trace it back to the source code to understand exactly where the vulnerable behavior comes from and how it can lead to file deletion outside the intended directory. We have 3 keywords in the title: Out-of-scope file deletion symlink TUS upload-cache eviction 1. Out-of-scope file deletion This one is pretty simple. Consider the following scenario: ...