CVE-2025-53826

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53826

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53826.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53826

Aliases

Published

2025-07-15T18:12:24.289Z

Modified

2025-12-05T10:19:28.348720Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

Details

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53826.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-305",
        "CWE-385",
        "CWE-613"
    ]
}

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53826.json"