CVE-2025-52902: File Browser Stored XSS Vulnerability via Markdown Preview
Summary
CVE-2025-52902: filebrowser allows Stored Cross-Site Scripting through the Markdown preview function. Affects github.com/filebrowser/filebrowser/v2 versions < 2.33.7. Fixed in 2.33.7. How to fix ↓
Also tracked for
The same CVE-2025-52902 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source file management application that allows users to manage files and directories through a web interface. It supports various functionalities, including file uploads, previews, and sharing. However, in version 2.32.0, it is vulnerable to a Stored Cross-Site Scripting (XSS) attack through its Markdown preview feature, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the Markdown preview function in File Browser, which allows users to upload Markdown files containing arbitrary HTML and JavaScript. When another user views the Markdown file, the embedded JavaScript is executed in their browser, potentially leading to unauthorized actions such as session hijacking or privilege escalation. This vulnerability is classified as a Stored XSS, where the malicious code is stored on the server and executed when the affected file is accessed.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.33.7
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.33.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to disable the Markdown preview feature until the vulnerability is resolved. This can be done by modifying the application settings to restrict Markdown file uploads or previews.
Conclusion
The Stored XSS vulnerability in File Browser's Markdown preview feature poses significant risks to users. It is crucial to update to the patched version 2.33.7 or implement workarounds to mitigate potential attacks. Regular monitoring for vulnerabilities using tools like Vulert is recommended to maintain application security.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into content that is stored on a server. When other users access this content, the scripts are executed in their browsers.
Users who access the malicious Markdown file may have their session tokens stolen or may be subjected to unauthorized actions, especially if they have elevated privileges.
Yes, you can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot update the package, consider disabling the Markdown preview feature or restricting Markdown file uploads as a temporary measure.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
