What is the CVSS score of CVE-2025-52996?

CVE-2025-52996 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Filebrowser are affected by CVE-2025-52996?

CVE-2025-52996 is a low-severity vulnerability in versions 2.32.0 and (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

Is there a public PoC exploit available for CVE-2025-52996?

Yes, a public proof-of-concept exploit is available for CVE-2025-52996. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-52996?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Filebrowser CVE-2025-52996

EUVD-2025-19579 LOW

Authentication Bypass by Primary Weakness (CWE-305)

2025-06-30 security-advisories@github.com

GHSA-3v48-283x-f2w4

Information Disclosure Filebrowser

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19579

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

PoC Detected

Aug 04, 2025 - 18:15 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 20:15 nvd

LOW 3.1

DescriptionGitHub Advisory

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.