EUVD-2025-19581

| CVE-2025-52901 MEDIUM
2025-06-30 [email protected] GHSA-rmwh-g367-mj4x
4.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Mar 16, 2026 - 01:25 vuln.today
EUVD ID Assigned
Mar 16, 2026 - 01:25 euvd
EUVD-2025-19581
Patch Released
Mar 16, 2026 - 01:25 nvd
Patch available
PoC Detected
Aug 04, 2025 - 18:15 vuln.today
Public exploit code
CVE Published
Jun 30, 2025 - 20:15 nvd
MEDIUM 4.5

Tags

Information Disclosure Filebrowser Suse

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.

Analysis

CVE-2025-52901 is a security vulnerability (CVSS 4.5). Risk factors: public PoC available. Vendor patch is available.

Technical Context

Vulnerability type not specified by vendor.

Affected Products

['Unspecified product']

Remediation

Apply the vendor-supplied patch immediately.

Priority Score

43
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +22
POC: +20

Vendor Status

Share

EUVD-2025-19581 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy