PT-2025-26977 · Unknown · Filebrowser

Mtausig · Published 2025-06-26 · Updated 2025-08-04 · CVE-2025-52900

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7

Description: The issue arises from File Browser not explicitly setting file access permissions for uploaded or created files, as well as its database. This results in files being readable by any operating system account on standard servers where the umask configuration has not been hardened, prior to version 2.33.7.

Recommendations: For versions prior to 2.33.7, update to version 2.33.7 to resolve the issue. As a temporary workaround, consider hardening the umask configuration on the server to restrict file access permissions until the update can be applied.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-52900

GHSA-JJ2R-455P-5GVF

GO-2025-3785

OPENSUSE-SU-2025:15405-1

Affected Products

Filebrowser

References · 69

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52900.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/ca86f916216620365c0f81629c0934ce02574d76 · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jj2r-455p-5gvf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3785 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj2r-455p-5gvf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52900 · Security Note
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-03_Filebrowser_Insecure_File_Permissions · Note
• https://suse.com/security/cve/CVE-2025-47871 · Note
• https://suse.com/security/cve/CVE-2025-53632 · Note
• https://twitter.com/CVEnew/status/1938249459634217109 · Twitter Post
• https://suse.com/security/cve/CVE-2025-54379 · Note
• https://t.me/cvetracker/27134 · Telegram Post