CVE-2025-52901: filebrowser
Vulnerability summary
CVE-2025-52901 is a medium (CVSS 6.5) vulnerability in filebrowser. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 30-06-2025PublishedVulnerability first disclosed.
- 04-08-2025Last modifiedVulnerability information updated.
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA4.5MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.04 pp
From 0.56% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFilebrowser
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Filebrowser1 product
- filebrowser< 2.33.9 | ≤ 2.33.0
Github.com/filebrowser1 product
- filebrowser≤ 1.11.0 | All versions (No fix recorded)
Github.com/filebrowser/filebrowser1 product
- v2< 2.33.9
3 vendors · 3 products
References
7 links- github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4xX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2X Refsource MISCWEBFIXPatch
