CVE-2025-52902: Filebrowser XSS Vulnerability

CVE-2025-52902 Overview

CVE-2025-52902 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in File Browser, an open-source file management interface used to upload, delete, preview, rename, and edit files within a specified directory. Versions prior to 2.33.7 fail to sanitize Markdown content rendered in the built-in preview. An authenticated user can upload a Markdown file containing embedded JavaScript. When another user previews the file, the browser executes the attacker-supplied script in the context of the File Browser session. The maintainers released version 2.33.7 with a fix that sanitizes rendered Markdown output.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized file operations within File Browser.

Affected Products

File Browser (filebrowser/filebrowser) versions prior to 2.33.7
All deployments exposing the Markdown preview feature to multiple users
Self-hosted File Browser instances shared across teams

Discovery Timeline

2025-06-26 - CVE-2025-52902 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52902

Vulnerability Analysis

The flaw resides in the frontend Markdown preview component of File Browser. When a user opens a .md file, the application renders the Markdown source to HTML and injects it into the DOM without sanitizing embedded HTML or JavaScript. Because Markdown syntax allows raw HTML passthrough, attacker-controlled <script> tags and event handler attributes are preserved and executed by the browser.

Exploitation requires low-privilege authenticated access to upload a Markdown file. When a victim previews that file, the script runs under the victim's session, providing access to authentication cookies, CSRF tokens, and the File Browser API. The scope change means the injected script can affect resources beyond the vulnerable component, including linked applications sharing the browser session.

Root Cause

The File Browser editor rendered untrusted Markdown-derived HTML directly into the page. The fix introduces the DOMPurify library to sanitize output before rendering, stripping dangerous tags and attributes from the previewed content.

Attack Vector

An attacker with upload permissions creates a Markdown file containing an inline <script> block or an HTML element with a JavaScript event handler such as onerror or onload. The attacker places the file in a directory accessible to the target user. When the victim navigates to the file and triggers the Markdown preview, the payload executes and can exfiltrate session data or perform authenticated actions on behalf of the victim.

text

 import ace, { Ace, version as ace_version } from "ace-builds";
 import modelist from "ace-builds/src-noconflict/ext-modelist";
 import "ace-builds/src-noconflict/ext-language_tools";
+import DOMPurify from "dompurify";
 
 import HeaderBar from "@/components/header/HeaderBar.vue";
 import Action from "@/components/header/Action.vue";
// Source: https://github.com/filebrowser/filebrowser/commit/f19943a42e8e092e811dffbe9f4623dac36f1f0d
// The patch imports DOMPurify in frontend/src/views/files/Editor.vue to sanitize Markdown preview output.

Detection Methods for CVE-2025-52902

Indicators of Compromise

Uploaded Markdown files containing <script> tags, javascript: URIs, or HTML event handlers such as onerror, onload, or onclick.
Unexpected outbound HTTP requests from user browsers to attacker-controlled hosts shortly after previewing a shared Markdown file.
Anomalous File Browser API calls originating from a legitimate user's session that the user did not initiate.

Detection Strategies

Scan the File Browser storage directory for .md files containing HTML tags or JavaScript event handlers using pattern matching.
Review web server access logs for File Browser preview endpoint requests followed by unusual redirect or session activity.
Monitor browser Content Security Policy (CSP) violation reports if a CSP is deployed in front of File Browser.

Monitoring Recommendations

Log all file upload events with uploader identity, filename, and MIME type for audit correlation.
Alert on authenticated sessions that suddenly perform bulk file operations after a preview action.
Track File Browser version across deployments and flag any instance running below 2.33.7.

How to Mitigate CVE-2025-52902

Immediate Actions Required

Upgrade all File Browser instances to version 2.33.7 or later without delay.
Audit existing Markdown files in shared directories for embedded scripts or suspicious HTML before allowing previews.
Rotate File Browser user credentials and session tokens if the platform was exposed to untrusted uploaders.

Patch Information

The fix is delivered in File Browser version 2.33.7 via commit f19943a in frontend/src/views/files/Editor.vue, which introduces DOMPurify to sanitize Markdown-derived HTML. Refer to the GitHub Security Advisory GHSA-4wx8-5gm2-2j97 and the upstream patch commit for verification details.

Workarounds

Restrict upload permissions to trusted users until the patch is deployed.
Disable or block access to the Markdown preview route via a reverse proxy rule.
Enforce a strict Content Security Policy (CSP) that blocks inline scripts on the File Browser origin.

bash

# Upgrade File Browser via Docker to the patched release
docker pull filebrowser/filebrowser:v2.33.7
docker stop filebrowser && docker rm filebrowser
docker run -d --name filebrowser \
  -v /srv/filebrowser/data:/srv \
  -v /srv/filebrowser/config:/config \
  -p 8080:80 \
  filebrowser/filebrowser:v2.33.7