https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:53:50 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10678 bdu:2025-10678 https://cve.radiocsirt.org/vuln/bdu:2025-10678 https://cve.radiocsirt.org/vuln/cnvd-2025-22704 cnvd-2025-22704 https://cve.radiocsirt.org/vuln/cnvd-2025-22704 https://cve.radiocsirt.org/vuln/euvd-2026-248968 EUVD-2026-248968 https://cve.radiocsirt.org/vuln/euvd-2026-248968 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52901 <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user&#39;s account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user&#39;s account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52901 https://cve.radiocsirt.org/vuln/ghsa-rmwh-g367-mj4x <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary</p> <p>URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. The *Filebrowser* violates this practice, since access tokens are used as GET parameters.</p> <p>## Impact</p> <p>The *JSON Web Token (JWT)* which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give the attacker full access to the user&#39;s account and, in consequence, to all sensitive files the user has access to.</p> <p>## Description</p> <p>Sensitive information in URLs is logged by several components (see the following examples), even if access is protected by TLS.</p> <p>* The browser history * The access logs on the affected web server * Proxy servers or reverse proxy servers * Third-party servers via the HTTP referrer header</p> <p>In case attackers can access certain logs, they could read the included sensitive data.</p> <p>## Proof of Concept ##</p> <p>When a file is downloaded via the web interface, the JWT is part of the URL:</p> <p>```http GET /api/raw/testdir/testfile.txt?auth=eyJh[...]_r4EQ HTTP/1.1 Host: filebrowser.local:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: http://filebrowser.local:8080/files/testdir/ Cookie: auth=eyJh[...]_r4EQ Upgrad…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary</p> <p>URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. The *Filebrowser* violates this practice, since access tokens are used as GET parameters.</p> <p>## Impact</p> <p>The *JSON Web Token (JWT)* which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give the attacker full access to the user&#39;s account and, in consequence, to all sensitive files the user has access to.</p> <p>## Description</p> <p>Sensitive information in URLs is logged by several components (see the following examples), even if access is protected by TLS.</p> <p>* The browser history * The access logs on the affected web server * Proxy servers or reverse proxy servers * Third-party servers via the HTTP referrer header</p> <p>In case attackers can access certain logs, they could read the included sensitive data.</p> <p>## Proof of Concept ##</p> <p>When a file is downloaded via the web interface, the JWT is part of the URL:</p> <p>```http GET /api/raw/testdir/testfile.txt?auth=eyJh[...]_r4EQ HTTP/1.1 Host: filebrowser.local:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: http://filebrowser.local:8080/files/testdir/ Cookie: auth=eyJh[...]_r4EQ Upgrad…</p> https://cve.radiocsirt.org/vuln/ghsa-rmwh-g367-mj4x https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1