CVE-2025-52901: Filebrowser Exposes Sensitive Data via URL Parameters
Summary
CVE-2025-52901: File Browser allows sensitive data to be transferred in URL. Affects github.com/filebrowser/filebrowser/v2 versions < 2.33.9. Fixed in 2.33.9. How to fix ↓
Also tracked for
The same CVE-2025-52901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Filebrowser is an open-source file management tool that allows users to manage files on a server through a web interface. It provides features such as file uploads, downloads, and directory browsing. However, it has a critical vulnerability that allows sensitive data, specifically JSON Web Tokens (JWT), to be transmitted via URL parameters, compromising user security.
Vulnerability Detail
The vulnerability arises from the practice of including sensitive information, such as session identifiers (JWTs), in URL query parameters. This can lead to exposure of these tokens in various logs, including browser history, web server access logs, and third-party servers through the HTTP referrer header. If an attacker gains access to these logs, they can hijack user sessions and access sensitive files, posing a significant security risk.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.33.9
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.33.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs that include sensitive information. Instead, transmit sensitive data through HTTP headers or the request body. For example, when making API calls, use the Authorization header to pass the JWT: 'Authorization: Bearer eyJh[...]_r4EQ'.
Conclusion
The vulnerability CVE-2025-52901 in Filebrowser poses a significant risk by exposing sensitive JWTs through URL parameters. Users are strongly advised to update to version 2.33.9 or later to mitigate this risk. Employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
The vulnerability allows sensitive data, specifically JWTs, to be transmitted via URL parameters, which can be logged and accessed by unauthorized parties.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, attackers can hijack user sessions, gaining full access to user accounts and sensitive files.
The CVSS score of this vulnerability is 4.5, indicating a moderate level of severity.
If an immediate update is not possible, implement the workaround by avoiding sensitive data in URLs and using HTTP headers instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
