Back to Database
Status published
High
CVE-2025-53826
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Vulnerability Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53826
Credits & Attribution
No credits recorded in the NVD database.
References
More from filebrowser
View All →CVE-2025-64523
FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function
High
7.2
CVE-2025-53893
File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing
High
7.7
CVE-2025-52997
File Browser Insecurely Handles Passwords
Medium
5.9
CVE-2025-52996
File Browser's Password Protection of Links Vulnerable to Bypass
Low
3.1
CVE-2025-52995
File Browser vulnerable to command execution allowlist bypass
High
8.1
Affected Vendor
filebrowser
View all reports →Affected Software
filebrowser
Vulnerable Versions:
= 2.39.0
Timeline
Official Publish:
July 15th, 2025
Last Modified:
July 15th, 2025
Added to House:
July 22nd, 2026