CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2025-52997
High (7.5) in filebrowser filebrowser. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/filebrowser/filebrowser/v2 2.34.1.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-307, CWE-521, CWE-1392
- Published
- Modified
- Record from
- the NVD, synced
Affected
- filebrowser:filebrowser
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cm2r-rg7r-p7gg | Go | github.com/filebrowser/filebrowser/v2 | <2.34.1 | 2.34.1 |
| GHSA-cm2r-rg7r-p7gg | Go | github.com/filebrowser/filebrowser | <=1.11.0 | no fix published |
| GO-2025-3792 | Go | github.com/filebrowser/filebrowser | all versions | no fix published |
| GO-2025-3792 | Go | github.com/filebrowser/filebrowser/v2 | <2.34.1 | 2.34.1 |