CVE-2025-52997

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

• CWE-307
• CWE-521
• CWE-1392

• https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93cPatch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7ggExploit, Vendor Advisory
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling

Published

Jun 30, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52991The Nix, Lix, and Guix package managers default to using tem…3.2
• CVE-2025-52992The Nix, Lix, and Guix package managers fail to properly set…3.2
• CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers …5.6
• CVE-2025-52994gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.…4.9
• CVE-2025-52995File Browser provides a file managing interface within a spe…6.6
• CVE-2025-52996File Browser provides a file managing interface within a spe…4.3
• CVE-2025-52998Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-52999jackson-core contains core low-level incremental ("streaming…8.7
• CVE-2025-53000The nbconvert tool, jupyter nbconvert, converts Jupyter note…7.8
• CVE-2025-53001Rejected reason: Reason: This candidate was issued in error.
• CVE-2025-53002LLaMA-Factory is a tuning library for large language models.…9.8
• CVE-2025-53003The Janssen Project is an open-source identity and access ma…8.2