PT-2025-26977 · Unknown · Filebrowser

Mtausig

·

Publicado

2025-06-26

·

Atualizado

2025-08-04

·

CVE-2025-52900

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7
Description: The issue arises from File Browser not explicitly setting file access permissions for uploaded or created files, as well as its database. This results in files being readable by any operating system account on standard servers where the umask configuration has not been hardened, prior to version 2.33.7.
Recommendations: For versions prior to 2.33.7, update to version 2.33.7 to resolve the issue. As a temporary workaround, consider hardening the umask configuration on the server to restrict file access permissions until the update can be applied.

Exploit

Correção

Incorrect Default Permissions

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2025-52900
GHSA-JJ2R-455P-5GVF
GO-2025-3785
OPENSUSE-SU-2025:15405-1

Produtos afetados

Filebrowser