Skip to content
Log inStart free trial

GHSA-rmwh-g367-mj4x CVE-2025-52901 GO-2025-3794

File Browser allows sensitive data to be transferred in URL

Medium Go
Severity
4.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.60%
Chance of exploitation in the next 30 days. Higher than 48.85% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-598 Use of HTTP Request With Sensitive Query String
Fix
2.33.9
Upgrade github.com/filebrowser/filebrowser/v2 to this version or later

Description

Summary

URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. The Filebrowser violates this practice, since access tokens are used as GET parameters.

Impact

The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give the attacker full access to the user's account and, in consequence, to all sensitive files the user has access to.

Description

Sensitive information in URLs is logged by several components (see the following examples), even if access is protected by TLS.

  • The browser history
  • The access logs on the affected web server
  • Proxy servers or reverse proxy servers
  • Third-party servers via the HTTP referrer header

In case attackers can access certain logs, they could read the included sensitive data.

Proof of Concept

When a file is downloaded via the web interface, the JWT is part of the URL:

GET /api/raw/testdir/testfile.txt?auth=eyJh[...]_r4EQ HTTP/1.1
Host: filebrowser.local:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://filebrowser.local:8080/files/testdir/
Cookie: auth=eyJh[...]_r4EQ
Upgrade-Insecure-Requests: 1
Priority: u=0, i

This also happens when a new command session is started:

GET /api/command/?auth=eyJh[...]YW8BA HTTP/1.1
Host: filebrowser.local:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: http://filebrowser.local:8080
Sec-WebSocket-Key: oqQMrF7R34D3lAkj1+ZHTw==
Connection: keep-alive, Upgrade
Cookie: auth=eyJh[...]YW8BA
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

Recommended Countermeasures

Sensitive data like session tokens or user credentials should be transmitted via HTTP headers or the HTTP body only, never in the URL.

Timeline

  • 2025-03-27 Identified the vulnerability in version 2.32.0
  • 2025-04-11 Contacted the project
  • 2025-04-29 Vulnerability disclosed to the project
  • 2025-06-25 Uploaded advisories to the project's GitHub repository
  • 2025-06-26 CVE ID assigned by GitHub
  • 2025-06-26 Fix released in version 2.33.9

References

Credits

Affected versions

Go

PackageVulnerableFixed in
github.com/filebrowser/filebrowser
<= 1.11.0
 No fix yet
github.com/filebrowser/filebrowser
all versions
 No fix yet
github.com/filebrowser/filebrowser/v2
< 2.33.9
2.33.9

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/filebrowser/filebrowser/v2 Go → 2.33.9

go
go get github.com/filebrowser/filebrowser/v2@v2.33.9 && go mod tidy

Severity breakdown

CVSS 3.1 4.5

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack vector
Adjacent
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Weakness

CWE-598: Use of HTTP Request With Sensitive Query String

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

How to prevent it
  • Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-833g-cqhp-h72j
File Browser: Share API exposes the password hash and bypass token
Low Also affects github.com/filebrowser/filebrowser
GHSA-83xp-526h-j3ww
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Medium Also affects github.com/filebrowser/filebrowser
GHSA-7rc3-g7h6-22m7
File Browser: Colliding username normalization gives two users the same home directory
High Also affects github.com/filebrowser/filebrowser
GHSA-8wc8-hf36-mjh9
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Medium Also affects github.com/filebrowser/filebrowser
GHSA-fmm7-x4gx-8jhr
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
High Also affects github.com/filebrowser/filebrowser
GHSA-xqp3-jq6g-x3qm
File Browser: Authentication Bypass via Proxy Auth Header Forgery
Critical Also affects github.com/filebrowser/filebrowser
GHSA-m93h-4hw7-5qcm
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
Critical Also affects github.com/filebrowser/filebrowser
GHSA-8c9q-7855-wfxq
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection
High Also affects github.com/filebrowser/filebrowser
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor