CVE-2025-53826 FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Attackers can replay stolen JWT tokens to maintain access after logout, bypassing session termination in File Browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53826?
CVE-2025-53826 is a high-severity vulnerability in filebrowser, published on 15 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
Which versions are affected by CVE-2025-53826?
6 open source packages ship an affected version, including github.com/filebrowser/filebrowser and github.com/filebrowser/filebrowser/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser Go | All versions | None |
github.com/filebrowser/filebrowser Go | All versions to 2.39.0 | None |
github.com/filebrowser/filebrowser Go | All versions to 2.39.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions | None |
github.com/filebrowser/filebrowser/v2 Go | All versions to 2.39.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions to 2.39.0 | None |
Products include Filebrowser Filebrowser.
How do I fix CVE-2025-53826?
No fix published yet.
Is CVE-2025-53826 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53826 exists.
Other vulnerabilities in filebrowser
- CVE-2026-32760 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
- CVE-2026-29188 File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2023-39612 Cross-site scripting in n/a
- CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
- CVE-2021-46398 Cross-Site Request Forgery in Filebrowser
Sources
Also known as CVE-2026-54095, GHSA-7xwp-2cpp-p8r7, GO-2025-3812.