CVE-2025-53826— FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Quick assessment
Affected
filebrowser filebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FileBrowser是开源的一款网页文件浏览器。提供指定目录下的文件管理界面，可用于上传、删除、预览、重命名和编辑您的文件。它允许创建多个用户，每个用户可以有自己的目录。它可以用作独立的应用程序或中间件。 FileBrowser 2.39.0版本存在安全漏洞，该漏洞源于身份验证系统存在缺陷，可能导致长期有效的JWT令牌。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-53826
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
FileBrowser 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FileBrowser是开源的一款网页文件浏览器。提供指定目录下的文件管理界面，可用于上传、删除、预览、重命名和编辑您的文件。它允许创建多个用户，每个用户可以有自己的目录。它可以用作独立的应用程序或中间件。 FileBrowser 2.39.0版本存在安全漏洞，该漏洞源于身份验证系统存在缺陷，可能导致长期有效的JWT令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filebrowser | filebrowser | = 2.39.0 | - |
|
II. Public POCs for CVE-2025-53826
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-53826
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: filebrowser
-
CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alia -
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90929
File Browser 2.5.0 Directory Deletion via Upload Failure Cle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-82237
filebrowser through 2.63.23 Stale Share Link via File Rename
Same vendor: filebrowser
-
CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alia -
CVE-2026-90929
File Browser 2.5.0 Directory Deletion via Upload Failure Cle -
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-82238
filebrowser 2.24.0 Race Condition via TUS concurrent PATCH u
Same weakness: CWE-305
-
CVE-2026-77185
Apache MINA SSHD: Asynchronous authentication can bypass sig -
CVE-2026-59563
HMAC Confirmation Token Unbinding in zscaler-mcp-server -
CVE-2026-88837
Busybox: busybox: httpd misidentifies yescrypt password hash -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86207
Authentication bypass leads to unauthorised access to N-cent
V. Comments for CVE-2025-53826
No comments yet