CVE-2025-52901 - CVE House
Back to Database
Status published Medium CVE-2025-52901

File Browser allows sensitive data to be transferred in URL

Vulnerability Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52901

Credits & Attribution

No credits recorded in the NVD database.

References

More from filebrowser

View All →
CVE-2025-64523
FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function
High 7.2
CVE-2025-53893
File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing
High 7.7
CVE-2025-53826
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
High 7.7
CVE-2025-52997
File Browser Insecurely Handles Passwords
Medium 5.9
CVE-2025-52996
File Browser's Password Protection of Links Vulnerable to Bypass
Low 3.1

Affected Vendor

filebrowser

View all reports →

Affected Software

filebrowser
Vulnerable Versions:
< 2.33.9

Timeline

Official Publish: June 30th, 2025
Last Modified: August 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-598

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.