Go/github.com/filebrowser/filebrowser/v2 CVE-2025-52901: medium 4.5, EPSS 0.60%

File Browser allows sensitive data to be transferred in URL

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.33.9 or later.

go get github.com/filebrowser/filebrowser/v2@v2.33.9

Affected

Fixed versions

Sources

• osv: GHSA-rmwh-g367-mj4x
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x
• https://nvd.nist.gov/vuln/detail/CVE-2025-52901
• https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-03_Filebrowser_Sensitive_Data_Transferred_In_URL
• https://pkg.go.dev/vuln/GO-2025-3794

CVE-2025-52901 · published 2025-06-30T17:44:36Z · modified 2025-08-04T17:22:24Z · JSON