PT-2025-26978 · Unknown · Filebrowser

Mtausig · Published 2025-06-26 · Updated 2026-03-10 · CVE-2025-52902

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7

Description: The Markdown preview function of File Browser is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser.

Recommendations: For versions prior to 2.33.7, update to version 2.33.7 to resolve the issue. As a temporary workaround, consider disabling the Markdown preview function until the update is applied. Restrict access to uploading Markdown files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-52902

GHSA-4WX8-5GM2-2J97

GO-2025-3784

OPENSUSE-SU-2025:15405-1

Affected Products

Filebrowser

References · 71

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52902.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/f19943a42e8e092e811dffbe9f4623dac36f1f0d · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4wx8-5gm2-2j97 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52902 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52902 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wx8-5gm2-2j97 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3784 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-04_Filebrowser_Stored_XSS · Note
• https://suse.com/security/cve/CVE-2025-46702 · Note
• https://suse.com/security/cve/CVE-2024-44906 · Note
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://pkg.go.dev/vuln/GO-2025-3784 · Note
• https://suse.com/security/cve/CVE-2025-53633 · Note