CVE-2025-52901
Medium
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.
SeverityMedium
CVSS4.5
Exploit probability—
ProductFilebrowser
PublishedJun 30, 2025
First seenJun 30, 2025
Weakness typeCWE-598CWE-598
How to fix
Update
- github.com/filebrowser/filebrowser/v22.33.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| filebrowser filebrowser | v ≤ 2.33.0 | — |
| github.com/filebrowser/filebrowser/v2Go | v < 2.33.9 | 2.33.9 |
| github.com/filebrowser/filebrowserGo | v ≤ 1.11.0, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.