Filebrowser EUVD-2025-23536

| CVE-2025-52997 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2025-06-30 security-advisories@github.com

GHSA-cm2r-rg7r-p7gg

Information Disclosure Filebrowser Suse

5.9

CVSS 3.1 · GitHub Advisory

Share

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

5

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-23536

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

Patch released

Mar 16, 2026 - 01:25 nvd

Patch available

PoC Detected

Aug 04, 2025 - 18:15 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 20:15 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Analysis

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Technical ContextAI

This vulnerability is classified as Improper Restriction of Excessive Authentication Attempts (CWE-307).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

More in Filebrowser

View all

CVE-2026-29188 CRITICAL Act Now POC

Unauthorized file operations in File Browser before fix. PoC and patch available.

CVE-2023-39612 CRITICAL Act Now POC

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr

CVE-2026-73612 HIGH This Week POC

Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,

CVE-2026-25890 HIGH This Week POC

Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio

CVE-2025-52903 HIGH This Week POC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2025-52904 HIGH This Week POC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2025-52995 HIGH This Week POC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2026-73611 HIGH This Week POC

File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut

CVE-2025-52902 HIGH This Week POC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2026-73613 HIGH This Week POC

Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet

CVE-2026-28492 MEDIUM This Month POC

File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s

CVE-2025-52900 MEDIUM This Month POC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all

CVE-2022-33106 CRITICAL POC

CVE-2026-44596 CRITICAL POC

CVE-2024-43042 CRITICAL POC

CVE-2024-39225 CRITICAL POC

CVE-2024-24767 CRITICAL POC

CVE-2023-6272 CRITICAL POC

CVE-2023-6756 CRITICAL POC

CVE-2023-49443 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed

Share

EUVD-2025-23536 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy