What is CVE-2025-52900?

CVE-2025-52900 is a medium-severity vulnerability in Filebrowser, classified under Incorrect Default Permissions. CVSS score: 5.5/10. Published 2025-06-26.

How severe is CVE-2025-52900?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Filebrowser

CVE-2025-52900

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.

EPSS: 0.002 (9.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Filebrowser — versions < 2.33.7

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-52900?: CVE-2025-52900 is a medium-severity vulnerability in Filebrowser, classified under Incorrect Default Permissions. CVSS score: 5.5/10. Published 2025-06-26.
How severe is CVE-2025-52900?: Medium severity. CVSS v3 base score is 5.5 out of 10.