PT-2025-46766 · Unknown · Filebrowser

Published 2025-11-12 · Updated 2026-02-03 · CVE-2025-64523

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.45.1

Description File Browser provides a file managing interface for tasks like uploading, deleting, previewing, renaming, and editing files. An Insecure Direct Object Reference (IDOR) exists in the application's share deletion functionality. This allows any authenticated user with share permissions to delete shared links belonging to other users without proper authorization checks. This can disrupt business operations through denial of service, potential data loss in collaborative environments, and compromise data confidentiality. The impact is significant in organizational settings where file sharing is critical for projects and collaboration.

Recommendations Update to version 2.45.1 or later.

Exploit

Fix

DoS

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2025-64523

GHSA-6CQF-CFHV-659G

GO-2025-4117

Affected Products

Filebrowser

References · 13

• 🔥 https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6cqf-cfhv-659g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64523.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64523 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6cqf-cfhv-659g · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4117 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/commit/291223b3cefe1e50fae8f73d70464b1dc25351a4 · Note
• https://twitter.com/CVEnew/status/1988820409664565521 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988777404437791198 · Twitter Post
• https://t.me/cveNotify/150733 · Telegram Post
• https://t.me/CVEtracker/37196 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ox660i/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post