CVE-2025-52997: Filebrowser

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Affected products

• Filebrowser Filebrowser: before 2.34.1 (fixed in 2.34.1)

Published 2025-06-30. Last modified 2026-06-17.