CVE-2025-52996

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-529977.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529989.8Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be CVE-2025-529998.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions CVE-2025-530007.8The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to CVE-2025-530029.8LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions CVE-2025-530038.2The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results CVE-2025-530049.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530059.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530069.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apa CVE-2025-530078.9arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability.CVE-2025-530086.5GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2025-530097.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions