Authentication Flaw in File Browser by File Browser Group
CVE-2025-53826

7.7HIGH

Key Information:

Vendor

Filebrowser

Status
Filebrowser
Vendor
CVE Published:
15 July 2025

What is CVE-2025-53826?

The File Browser application, used for managing files within specific directories, has a significant vulnerability related to its authentication system. In version 2.39.0, the application issues long-lived JSON Web Tokens (JWT) that continue to be valid even after a user logs out. This flaw potentially allows unauthorized access to a user's session, as the tokens do not expire as expected. As of now, there are no patches available to resolve this issue, making it crucial for users to be aware of the risks involved.

Affected Version(s)

filebrowser = 2.39.0

References

https://github.com/filebrowser/filebrowser/security/advis...
x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/issues/5216
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.