Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2025-53826

FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

filebrowser filebrowser

  • = 2.39.0affected

References