CVE-2025-52902

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.

• CWE-79
• CWE-80

• https://github.com/filebrowser/filebrowser/commit/f19943a42e8e092e811dffbe9f4623dac36f1f0dPatch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4wx8-5gm2-2j97Exploit, Vendor Advisory

Published

Jun 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52897GLPI is a Free Asset and IT Management Software package. In …6.1
• CVE-2025-52898Frappe is a full-stack web application framework. Prior to v…8.8
• CVE-2025-52899Tuleap is an Open Source Suite created to facilitate managem…5.3
• CVE-2025-5290The Borderless – Elementor Addons and Templates plugin for W…6.4
• CVE-2025-52900File Browser provides a file managing interface within a spe…5.5
• CVE-2025-52901File Browser provides a file managing interface within a spe…6.5
• CVE-2025-52903File Browser provides a file managing interface within a spe…8
• CVE-2025-52904File Browser provides a file managing interface within a spe…8
• CVE-2025-52905Improper Input Validation vulnerability in TOTOLINK X6000R a…7.5
• CVE-2025-52906Improper Neutralization of Special Elements used in an OS Co…9.8
• CVE-2025-52907Improper Input Validation vulnerability in TOTOLINK X6000R a…8.8
• CVE-2025-52908An issue was discovered in the Wi-Fi driver in Samsung Mobil…9.8