CVE-2025-52996
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-305
- Affected
- filebrowser/filebrowser
- Source
- security-advisories@github.com
References
- https://github.com/filebrowser/filebrowser/issues/5239Issue Tracking
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3v48-283x-f2w4Exploit, Vendor Advisory
- https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-02_Filebrowser_Password_Protection_Of_Links_Bypassable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.