CVE-2025-52996: File Browser's Password Protection Bypass Vulnerability
Summary
CVE-2025-52996: File Browser's password protection of links is bypassable. Affects github.com/filebrowser/filebrowser/v2 versions < 2.42.1. No fix is published. How to fix ↓
Also tracked for
The same CVE-2025-52996 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source file management application that allows users to share files securely via links. It offers features such as password protection for shared links, enabling users to control access to their files. However, a flaw in its implementation has led to a vulnerability where password protection can be bypassed, potentially exposing sensitive files to unauthorized access.
Vulnerability Detail
The vulnerability arises from the way File Browser handles shared links. When a file is shared, two links are generated: a 'Download Link' and a direct download link that is not protected by the password. Users may inadvertently share the unprotected link, leading to unauthorized access to sensitive files. This flaw creates a false sense of security for file owners, as they believe their files are protected when they may not be. Attackers can exploit this by accessing the unprotected link, allowing them to download files without needing the password.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should refrain from sharing the second link provided in the sharing dialog. Instead, ensure that only the password-protected link is shared. Additionally, users should regularly check their logs and browser history to ensure that no unprotected links have been inadvertently shared.
Conclusion
The CVE-2025-52996 vulnerability in File Browser highlights a significant flaw in the password protection mechanism for shared links. Users are encouraged to update to the latest version to mitigate the risk of unauthorized access to sensitive files. By following the recommended steps and workarounds, users can enhance their security posture.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
CVE-2025-52996 is a vulnerability in File Browser that allows password protection on shared links to be bypassed, potentially exposing sensitive files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is unauthorized access to shared files, as attackers can download files using the unprotected link without needing the password.
You can update your File Browser package by running 'go get github.com/filebrowser/filebrowser/v2@latest' in your terminal to ensure you have the latest patched version.
Yes, avoid sharing the unprotected link generated by the application and ensure that only the password-protected link is shared.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
