CVE-2025-52900: filebrowser Insecure File Permissions Vulnerability
Summary
CVE-2025-52900: filebrowser Sets Insecure File Permissions. Affects github.com/filebrowser/filebrowser/v2 versions < 2.33.7. Fixed in 2.33.7. How to fix ↓
Also tracked for
The same CVE-2025-52900 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Filebrowser is an open-source file management application that allows users to manage files and directories through a web interface. It is designed to be simple and user-friendly, providing functionalities such as file uploads, downloads, and organization. However, it has been found to have a critical vulnerability related to file permissions, which can expose sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability arises from the fact that file access permissions for files uploaded or created through Filebrowser are not explicitly set by the application. This means that on standard Linux servers, where the umask configuration is not hardened, all uploaded files and the database are world-readable. The default permissions for new files are set to 0644, allowing any operating system account to read these files. This can lead to unauthorized access to sensitive information, including password hashes stored in the database, by any user or application on the same server.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.33.7
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.33.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the filebrowser data directory to restrict access. This can be done with the following command: 'chmod o-rwx -R /srv/filebrowser/datadir'.
Conclusion
The filebrowser application has a vulnerability related to insecure file permissions, allowing unauthorized access to sensitive files and database information. Users are advised to update to the patched version and apply necessary permission changes to mitigate risks.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The risks include unauthorized access to sensitive files and database information, which can lead to data breaches and exploitation of user accounts.
Yes, a patch is available in version 2.33.7 of filebrowser, which addresses the insecure file permissions issue.
If you cannot update immediately, ensure to manually change the permissions of the filebrowser data directory to restrict access as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
