What is the CVSS score of CVE-2025-52900?

CVE-2025-52900 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Filebrowser are affected by CVE-2025-52900?

CVE-2025-52900 presents moderate security risk, a incorrect default permissions vulnerability rated CVSS 5.5. Attackers could gain access beyond their authorized level.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52900?

Yes, a public proof-of-concept exploit is available for CVE-2025-52900. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-52900?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review and tighten file/resource permissions.

Filebrowser CVE-2025-52900

EUVD-2025-19199 MEDIUM

Incorrect Default Permissions (CWE-276)

2025-06-26 security-advisories@github.com

GHSA-jj2r-455p-5gvf

Privilege Escalation Filebrowser Suse

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-19199

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

Patch released

Mar 15, 2026 - 23:54 nvd

Patch available

PoC Detected

Jul 10, 2025 - 01:17 vuln.today

Public exploit code

CVE Published

Jun 26, 2025 - 15:15 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.

Analysis

Technical ContextAI

Privilege escalation allows a low-privileged user or process to gain elevated permissions beyond what was originally authorized. This vulnerability is classified as Incorrect Default Permissions (CWE-276).

RemediationAI

A vendor patch is available — apply it immediately. Apply the principle of least privilege. Keep systems patched. Monitor for suspicious privilege changes. Use mandatory access controls (SELinux, AppArmor).