CVE-2025-52997 File Browser Insecurely Handles Passwords
Attackers can brute-force user passwords due to missing rate limiting and weak password policies, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52997?
CVE-2025-52997 is a medium-severity authentication bypass vulnerability in filebrowser, published on 30 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
Which versions are affected by CVE-2025-52997?
6 open source packages ship an affected version, including github.com/filebrowser/filebrowser and github.com/filebrowser/filebrowser/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser Go | All versions | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.34.1 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.34.1 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.34.1 |
Products include Filebrowser Filebrowser.
How do I fix CVE-2025-52997?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-52997 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52997 exists.
Other vulnerabilities in filebrowser
- CVE-2026-32760 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
- CVE-2026-29188 File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2023-39612 Cross-site scripting in n/a
- CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
- CVE-2021-46398 Cross-Site Request Forgery in Filebrowser
Sources
Also known as GHSA-cm2r-rg7r-p7gg, GO-2025-3792.