CVE-2025-52900
published 2025-06-26CVE-2025-52900: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file…
PriorityP429medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.19%
8.9th percentile
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| filebrowser | filebrowser | < 2.33.7 | 2.33.7 |
| github.com | filebrowser_filebrowser | 0 – 1.11.0 | — |
| github.com | filebrowser_filebrowser_v2 | >= 0 < 2.33.7 | 2.33.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
osv·2025-07-28
CVE-2025-52900 filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
OSV
filebrowser Sets Insecure File Permissions
osv·2025-06-27
CVE-2025-52900 [MEDIUM] filebrowser Sets Insecure File Permissions
filebrowser Sets Insecure File Permissions
## Summary ##
The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application.
The same is true for the database used by File Browser. On standard servers where the *umask* configuration has not been hardened before, this makes all the stated files readable by any operating system account.
## Impact ##
The default permissions for new files on a standard Linux system are `0644`, making them world-readable.
That means that at least the following parties have full read access to all files managed by the Filebrowser from all *scopes*, as well as its database (including the password hashes stored in there):
* All OS accounts on the server
* All other applications running on the same server
GHSA
filebrowser Sets Insecure File Permissions
ghsa·2025-06-27
CVE-2025-52900 [MEDIUM] CWE-276 filebrowser Sets Insecure File Permissions
filebrowser Sets Insecure File Permissions
## Summary ##
The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application.
The same is true for the database used by File Browser. On standard servers where the *umask* configuration has not been hardened before, this makes all the stated files readable by any operating system account.
## Impact ##
The default permissions for new files on a standard Linux system are `0644`, making them world-readable.
That means that at least the following parties have full read access to all files managed by the Filebrowser from all *scopes*, as well as its database (including the password hashes stored in there):
* All OS accounts on the server
* All other applications running on the same server
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-26
Published