CVE-2025-53826 — FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Brows…
Published: 2025-07-15 · CVSS: 7.7 · CVSS 4.0
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7