CVE-2025-52901CWE-598

File Browser allows sensitive data to be transferred in URL

Medium · published June 30, 2025

CVSS v3.1
4.5
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2025-06-30T19:56Z
EPSS history
Timeline
  • 30 JUN 19:56Z
    File Browser allows sensitive data to be transferred in URL
    cvelistv5