CVE-2025-52902 - CVE House
Back to Database
Status published High CVE-2025-52902

File Browser has Stored Cross-Site Scripting vulnerability

Vulnerability Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52902

Credits & Attribution

No credits recorded in the NVD database.

References

More from filebrowser

View All →
CVE-2025-64523
FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function
High 7.2
CVE-2025-53893
File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing
High 7.7
CVE-2025-53826
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
High 7.7
CVE-2025-52997
File Browser Insecurely Handles Passwords
Medium 5.9
CVE-2025-52996
File Browser's Password Protection of Links Vulnerable to Bypass
Low 3.1

Affected Vendor

filebrowser

View all reports →

Affected Software

filebrowser
Vulnerable Versions:
< 2.33.7

Timeline

Official Publish: June 26th, 2025
Last Modified: June 26th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-79 CWE-80

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1059 Command and Scripting Interpreter
Execution
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact