CVE-2025-53826 — Authentication Bypass by Primary Weakness in Filebrowser Filebrowser

CWE-305 — Authentication Bypass by Primary WeaknessCWE-385 — Covert Timing ChannelCWE-613 — Insufficient Session ExpirationCWE-384 — Session Fixation5 documents4 sources
Severity
7.7HIGHNVD
EPSS
0.3%
top 46.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Filebrowser FilebrowserGithub.com Filebrowser Filebrowser V2Filebrowser
Timeline
PublishedJul 15
Latest updateJul 28

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5filebrowser/filebrowser= 2.39.0

🔴Vulnerability Details

4
OSV
File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser↗2025-07-28
▶
OSV
File Browser’s insecure JWT handling can lead to session replay attacks after logout↗2025-07-16
▶
GHSA
File Browser’s insecure JWT handling can lead to session replay attacks after logout↗2025-07-16
▶
CVEList
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout↗2025-07-15
▶
CVE-2025-53826 — Filebrowser Filebrowser vulnerability | cvebase