Vulnerability Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Filebrowser | Filebrowser | < 2.33.7 |
Related Weaknesses (CWE)
References
- https://github.com/filebrowser/filebrowser/commit/ca86f916216620365c0f81629c0934Patch
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jj2r-455p-5gExploitVendor Advisory
FAQ
What is CVE-2025-52900?
CVE-2025-52900 is a vulnerability with a CVSS score of 5.5 (MEDIUM). File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or ...
How severe is CVE-2025-52900?
CVE-2025-52900 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-52900?
Check the references section above for vendor advisories and patch information. Affected products include: Filebrowser Filebrowser.