Moderate severityNVD Advisory· Published Jun 26, 2025· Updated Jun 26, 2025
File Browser has Insecure File Permissions
CVE-2025-52900
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/filebrowser/filebrowser/v2Go | < 2.33.7 | 2.33.7 |
github.com/filebrowser/filebrowserGo | <= 1.11.0 | — |
Affected products
4- ghsa-coords3 versionspkg:golang/github.com/filebrowser/filebrowserpkg:golang/github.com/filebrowser/filebrowser/v2pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
<= 1.11.0+ 2 more
- (no CPE)range: <= 1.11.0
- (no CPE)range: < 2.33.7
- (no CPE)range: < 0.0.20250730T213748-1.1
- Range: < 2.33.7
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-jj2r-455p-5gvfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-52900ghsaADVISORY
- github.com/filebrowser/filebrowser/commit/ca86f916216620365c0f81629c0934ce02574d76ghsax_refsource_MISCWEB
- github.com/filebrowser/filebrowser/security/advisories/GHSA-jj2r-455p-5gvfghsax_refsource_CONFIRMWEB
- github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-03_Filebrowser_Insecure_File_PermissionsghsaWEB
- pkg.go.dev/vuln/GO-2025-3785ghsaWEB
News mentions
0No linked articles in our index yet.