Cyber Resilience

CVE-2025-53826

Auth Bypass in Filebrowser 2.39.0

Public PoCAuth Bypass
Published
15 July 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v4 7.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0050 40th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2025-53826 is a high-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Filebrowser Filebrowser. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-12 (Session Termination) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-53826 is a critical authentication vulnerability in File Browser version 2.39.0, an open-source web-based file manager that provides interfaces for uploading, deleting, previewing, renaming, and editing files within a specified directory. The flaw stems from the authentication system issuing long-lived JSON Web Tokens (JWTs) that remain valid even after a user explicitly logs out, mapped to CWEs-305, CWE-385, and CWE-613. Published on 2025-07-15, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Any network-accessible attacker can exploit this vulnerability without authentication privileges or user interaction by obtaining a valid JWT token, such as through phishing, token leakage, or prior legitimate access. With the token, the attacker gains persistent unauthorized access to perform full file management operations—uploading malicious files, deleting data, previewing sensitive content, renaming, or editing files—within the configured directory, resulting in high impacts to confidentiality, integrity, and availability.

The GitHub security advisory GHSA-7xwp-2cpp-p8r7 and related issue #5216 confirm that, as of publication, no patches or mitigations are available for File Browser 2.39.0. Security practitioners should monitor for updates, restrict network exposure, implement strict token handling, and consider alternative file managers until remediation is released.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after…

more

the user logs out. As of time of publication, no known patches exist.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
T1563 Remote Service Session Hijacking Lateral Movement
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.
T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-52996Same product: Filebrowser Filebrowser
CVE-2023-39612Same product: Filebrowser Filebrowser
CVE-2025-52902Same product: Filebrowser Filebrowser
CVE-2026-34530Same product: Filebrowser Filebrowser
CVE-2026-34529Same product: Filebrowser Filebrowser
CVE-2026-30934Same product: Filebrowser Filebrowser
CVE-2026-35605Same product: Filebrowser Filebrowser
CVE-2026-25889Same product: Filebrowser Filebrowser
CVE-2026-32759Same product: Filebrowser Filebrowser
CVE-2026-35606Same product: Filebrowser Filebrowser

Affected Assets

filebrowser
filebrowser
2.39.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V7.2.4

Mitigating Controls (NIST 800-53 r5) AI

AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.

Requires unique identification and authentication of users, structurally blocking bypass of the mechanism.

Requires unique identification and authentication of non-organizational users, blocking bypass paths.

Covert channel analysis directly identifies timing channels that could leak information.

Enforces approved authorizations so a bypass weakness cannot be exploited to reach resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.

PR.AA-01 mostly match
prevents

Credential lifecycle management directly includes enforcing session expiration to prevent reuse.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.

PR.AA-05 mostly match
prevents

Authorization policy enforcement and review covers terminating stale sessions to limit access scope.

DE.CM-09 partial match
prevents

Runtime monitoring of hardware/software behavior can detect anomalous timing patterns that indicate covert channels.

ID.RA-01 partial match
prevents

Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect authentication bypass conditions before deployment.

A.8.15 Logging partial match
degrades

Detailed logging can reveal timing anomalies but does not prevent covert timing channels.

finds

Continuous monitoring may detect timing-based exfiltration but does not eliminate the channel itself.

mitigates

Network segmentation reduces attack surface but does not address intra-process timing channels.

mitigates

Network segregation limits external timing observation but not internal covert timing.

prevents

Secure development lifecycle reduces likelihood of introducing bypass flaws during implementation.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Ubuntu 24.04 (1 rule)
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-305

References