CVE-2025-53826: 
Wolfi vulnerability analysis and mitigation

File Browser version 2.39.0 contains a critical authentication vulnerability (CVE-2025-53826) where the application's authentication system issues long-lived JWT tokens that remain valid even after user logout. The vulnerability was discovered and disclosed on July 15, 2025, affecting the File Browser application which provides a file managing interface for uploading, deleting, previewing, renaming, and editing files (GitHub Advisory).

The vulnerability stems from improper JWT (JSON Web Token) token handling in the authentication system. The backend does not track active sessions or invalidate existing tokens upon logout. The token validation only depends on expiry and user store timestamps, without implementing a server-side blacklist or token invalidation mechanism. The vulnerability has been assigned a CVSS v4.0 score of 7.7 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P (NVD).

The vulnerability allows attackers to perform session replay attacks. Even after a user explicitly logs out, previously issued JWT tokens remain valid until their natural expiration. This means any captured token can be replayed post-logout to maintain unauthorized access to the system. The impact violates OWASP Top 10 A2:2021 - Broken Authentication standards (GitHub Advisory).

As of the time of publication, no patches exist for this vulnerability. However, recommended mitigations include implementing JWT invalidation on logout via session store or token blacklist, reducing JWT expiration times where possible, and considering the use of short-lived tokens with refresh token mechanisms (GitHub Advisory).

The vulnerability has prompted discussion in the File Browser community, leading to the creation of Issue #5216 which outlines plans to improve session JWT handling. The proposed changes include replacing JWT session tokens with random identifiers stored in the database, implementing proper token invalidation upon logout, and revising the token transmission methods (GitHub Issue).