CVE-2025-52901

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2	Patch
https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9	Release Notes
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*

History

10 Jul 2025, 14:48

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-30 20:15

Updated : 2025-07-10 14:48

NVD link : CVE-2025-52901

Mitre link : CVE-2025-52901

CVE.ORG link : CVE-2025-52901

JSON object : View

Products Affected

filebrowser

filebrowser

CWE

CWE-598

Use of GET Request Method With Sensitive Query Strings

{"id": "CVE-2025-52901", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-06-30T20:15:25.390", "references": [{"url": "https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9."}, {"lang": "es", "value": "File Browser proporciona una interfaz de gesti\u00f3n de archivos dentro de un directorio espec\u00edfico y permite cargar, eliminar, previsualizar, renombrar y editar archivos. Antes de la versi\u00f3n 2.33.9, los tokens de acceso se utilizaban como par\u00e1metros GET. El token web JSON (JWT), utilizado como identificador de sesi\u00f3n, se filtraba a cualquiera que tuviera acceso a las URL a las que acced\u00eda el usuario. Esto otorgaba a un atacante acceso total a la cuenta del usuario y, en consecuencia, a todos los archivos confidenciales a los que ten\u00eda acceso. Este problema se ha corregido en la versi\u00f3n 2.33.9."}], "lastModified": "2025-07-10T14:48:43.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E2B3263-B3C5-4FAC-B62E-AADF39D31C1A", "versionEndIncluding": "2.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}