Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-53826 is a high-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Filebrowser Filebrowser. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-53826 is a critical authentication vulnerability in File Browser version 2.39.0, an open-source web-based file manager that provides interfaces for uploading, deleting, previewing, renaming, and editing files within a specified directory. The flaw stems from the authentication system issuing long-lived JSON Web Tokens (JWTs) that remain valid even after a user explicitly logs out, mapped to CWEs-305, CWE-385, and CWE-613. Published on 2025-07-15, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Any network-accessible attacker can exploit this vulnerability without authentication privileges or user interaction by obtaining a valid JWT token, such as through phishing, token leakage, or prior legitimate access. With the token, the attacker gains persistent unauthorized access to perform full file management operations—uploading malicious files, deleting data, previewing sensitive content, renaming, or editing files—within the configured directory, resulting in high impacts to confidentiality, integrity, and availability.
The GitHub security advisory GHSA-7xwp-2cpp-p8r7 and related issue #5216 confirm that, as of publication, no patches or mitigations are available for File Browser 2.39.0. Security practitioners should monitor for updates, restrict network exposure, implement strict token handling, and consider alternative file managers until remediation is released.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21540
Vulnerability Data
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after…
more
the user logs out. As of time of publication, no known patches exist.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
V6.4.3V7.2.4
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Requires unique identification and authentication of users, structurally blocking bypass of the mechanism.
Requires unique identification and authentication of non-organizational users, blocking bypass paths.
Covert channel analysis directly identifies timing channels that could leak information.
Enforces approved authorizations so a bypass weakness cannot be exploited to reach resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Runtime monitoring of hardware/software behavior can detect anomalous timing patterns that indicate covert channels.
Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect authentication bypass conditions before deployment.
Detailed logging can reveal timing anomalies but does not prevent covert timing channels.
Continuous monitoring may detect timing-based exfiltration but does not eliminate the channel itself.
Network segmentation reduces attack surface but does not address intra-process timing channels.
Network segregation limits external timing observation but not internal covert timing.
Secure development lifecycle reduces likelihood of introducing bypass flaws during implementation.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-305