Vulnerability DatabaseCVE-2025-52901

CVE-2025-52901:
vulnerability analysis and mitigation

Overview

CVE-2025-52901 affects File Browser, a file managing interface software, prior to version 2.33.9. The vulnerability was discovered on March 27, 2025, and was patched in version 2.33.9 released on June 26, 2025. The issue involves access tokens being used as GET parameters, which exposes sensitive session identifiers in URLs (GitHub Advisory).

Technical details

The vulnerability is classified as CWE-598 (Use of GET Request Method With Sensitive Query Strings) with a CVSS v3.1 score of 4.5 (Medium). The technical issue stems from the transmission of JSON Web Tokens (JWT) as GET parameters in URLs, which violates security best practices for handling sensitive data. The vulnerability affects multiple endpoints, including file downloads and command sessions, where authentication tokens are exposed in the URL parameters (GitHub Advisory).

Impact

When exploited, this vulnerability allows attackers with access to URLs or logs to obtain valid JWT session identifiers. This exposure can lead to full access to a user's account and all sensitive files the user has access to. The sensitive information can be leaked through various channels including browser history, server access logs, proxy servers, and third-party servers via HTTP referrer headers (GitHub Advisory).

Mitigation and workarounds

The vulnerability has been fixed in File Browser version 2.33.9. The recommended countermeasure is to upgrade to this version or later. For those unable to upgrade immediately, it's recommended to transmit sensitive data like session tokens or user credentials via HTTP headers or the HTTP body only, never in the URL (GitHub Advisory).