Login Request a demo
Medium severity · published Jun 30, 2025
CVE-2025-52901
File Browser allows sensitive data to be transferred in URL
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
filebrowser · filebrowser
< 2.33.9 · source: vendor, NVD
Affected product
FI
filebrowser
filebrowser
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52901
Patch
https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2
Release Notes
https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9
Exploit
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x
github.com
https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-03_Filebrowser_Sensitive_Data_Transferred_In_URL
More from filebrowser
9.8
CVE-2026-72839
filebrowser through 2.63.16 Privilege Escalation via Signup
9.8
CVE-2026-34528
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution
9.8
CVE-2026-32760
File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
9.8
CVE-2025-53826
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
9.3
CVE-2026-54088
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)