CVE-2025-52996

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.

Reserved 2025-06-24 | Published 2025-06-30 | Updated 2025-06-30 | Assigner GitHub_M

Problem types

CWE-305: Authentication Bypass by Primary Weakness

Product status

<= 2.32.0
affected

References

github.com/...rowser/security/advisories/GHSA-3v48-283x-f2w4

github.com/filebrowser/filebrowser/issues/5239

cve.org (CVE-2025-52996)

nvd.nist.gov (CVE-2025-52996)

Download JSON