CVE-2025-52997: filebrowser
Vulnerability summary
CVE-2025-52997 is a high (CVSS 7.5) vulnerability in filebrowser. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 30-06-2025PublishedVulnerability first disclosed.
- 04-08-2025Last modifiedVulnerability information updated.
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.02 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFilebrowser
Maturity: poc
Weaknesses
CWE · root cause- CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
- CWE-521Weak Password RequirementsThe product does not require that users should have strong passwords.
- CWE-1392Use of Default CredentialsThe product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Affected systems
Chainguard2 products
- filebrowser< 2.36.0-r0
- filebrowser-compat< 2.36.0-r0
Wolfi2 products
- filebrowser< 2.36.0-r0
- filebrowser-compat< 2.36.0-r0
Filebrowser1 product
- filebrowser< 2.34.1
Github.com/filebrowser1 product
- filebrowser≤ 1.11.0 | All versions (No fix recorded)
Github.com/filebrowser/filebrowser1 product
- v2< 2.34.1
5 vendors · 7 products
References
7 links- github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7ggX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93cX Refsource MISCFIXWEBPatch
