CVE-2025-52900 - CVE House

Back to Database

Status published Medium CVE-2025-52900

File Browser has Insecure File Permissions

5.5 CVSS

Vulnerability Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52900

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from filebrowser

View All →

FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

File Browser Insecurely Handles Passwords

File Browser's Password Protection of Links Vulnerable to Bypass

Affected Vendor

filebrowser

View all reports →

Affected Software

filebrowser

Vulnerable Versions:

< 2.33.7

Timeline

Official Publish: June 26th, 2025

Last Modified: June 26th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification

Defense Evasion

T1078 Valid Accounts

T1574 Hijack Execution Flow

Privilege Escalation

T1021 Remote Services

Lateral Movement

T1005 Data from Local System