CVE-2025-52996 — Authentication Bypass by Primary Weakness in Filebrowser
Severity
4.3MEDIUMNVD
CNA3.1
EPSS
0.1%
top 78.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 30
Latest updateJul 28
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages4 packages
🔴Vulnerability Details
4OSV▶
File Browser's password protection of links is bypassable in github.com/filebrowser/filebrowser↗2025-07-28