CVE-2025-52900: Insecure File Permissions in filebrowser Package
Summary
CVE-2025-52900: filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2025-52900 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The filebrowser package is a web-based file manager that allows users to manage files on their servers through a user-friendly interface. It is widely used for its simplicity and ease of integration into various applications. However, the package has been identified to set insecure file permissions, which can lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability arises from the filebrowser package's improper handling of file permissions, which can result in files being accessible to unauthorized users. This issue can lead to data breaches, where sensitive information may be exposed or manipulated by malicious actors. The vulnerability is present in versions prior to 2.33.7 for the v2 package and from the initial release for the main package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually adjust the file permissions of the affected files to restrict access. This can be done using the following command:
chmod 600 /path/to/your/file
This command sets the file permissions to read and write for the owner only, preventing unauthorized access.
Conclusion
The filebrowser package has a critical vulnerability (CVE-2025-52900) that sets insecure file permissions, potentially exposing sensitive data. Users are advised to update to version 2.33.7 or later to mitigate this risk. For those unable to update immediately, adjusting file permissions can serve as a temporary workaround.
See every vulnerability recorded for github.com/filebrowser/filebrowser →
FAQ
CVE-2025-52900 is a vulnerability in the filebrowser package that allows for insecure file permissions, potentially exposing sensitive files to unauthorized users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential data breaches, and manipulation of critical information.
Yes, a patch is available in version 2.33.7 of the filebrowser package. It is recommended to update to this version or later.
If an immediate update is not possible, you should implement the recommended workaround by adjusting file permissions to restrict access.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser.
