#VU112158 Weak password requirements in FileBrowser - CVE-2025-52997

Vulnerability identifier: #VU112158

Vulnerability risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2025-52997

CWE-ID: CWE-521

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
FileBrowser
Web applications / Modules and components for CMS

Vendor: File Browser

Description

The vulnerability allows an attacker to perform brute-force attack and guess the password.

The vulnerability exists due to weak password requirements. An attacker can perform a brute-force attack and guess users' passwords.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FileBrowser: 2.0.0 - 2.34.0

---

External links
https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.