https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:53:04 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-22698 cnvd-2025-22698 https://cve.radiocsirt.org/vuln/cnvd-2025-22698 https://cve.radiocsirt.org/vuln/euvd-2026-247609 EUVD-2026-247609 https://cve.radiocsirt.org/vuln/euvd-2026-247609 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53826 <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-53826 https://cve.radiocsirt.org/vuln/ghsa-7xwp-2cpp-p8r7 <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser, Go: github.com/filebrowser/filebrowser/v2</p> <p>### Summary</p> <p>File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE&#39;s listed in this report for further reference and system standards. In summary, the main issue is:</p> <p>- Tokens remain valid after logout (session replay attacks)</p> <p>In this report, I used docker as the documentation instruct:</p> <p>``` docker run \ -v filebrowser_data:/srv \ -v filebrowser_database:/database \ -v filebrowser_config:/config \ -p 8080:80 \ filebrowser/filebrowser ```</p> <p>### Details</p> <p>**Issue: Tokens remain valid after logout (session replay attacks)**</p> <p>After logging in and receiving a JWT token, the user can explicitly &#34;log out.&#34; However, this action does not invalidate the issued JWT. Any captured token can be replayed post-logout until it expires naturally. The backend does not track active sessions or invalidate existing tokens on logout. Login request:</p> <p>``` POST /api/login HTTP/1.1 Host: machine.local:8090 Content-Length: 69</p> <p>{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;password-here&#34;,&#34;recaptcha&#34;:&#34;&#34;} ```</p> <p>The check found in the code `https://github.com/filebrowser/filebrowser/blob/master/http/auth.go` is not enough. There is no server-side blacklist or token invalidation on logout. Token renewal and validity only depends on expiry and user store timestamps:</p> <p>``` expired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour), true) updated := tk.IssuedAt != nil &amp;&amp; tk.IssuedAt.Unix() &lt; d.store.Users.LastUpdate(tk.User.ID…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser, Go: github.com/filebrowser/filebrowser/v2</p> <p>### Summary</p> <p>File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE&#39;s listed in this report for further reference and system standards. In summary, the main issue is:</p> <p>- Tokens remain valid after logout (session replay attacks)</p> <p>In this report, I used docker as the documentation instruct:</p> <p>``` docker run \ -v filebrowser_data:/srv \ -v filebrowser_database:/database \ -v filebrowser_config:/config \ -p 8080:80 \ filebrowser/filebrowser ```</p> <p>### Details</p> <p>**Issue: Tokens remain valid after logout (session replay attacks)**</p> <p>After logging in and receiving a JWT token, the user can explicitly &#34;log out.&#34; However, this action does not invalidate the issued JWT. Any captured token can be replayed post-logout until it expires naturally. The backend does not track active sessions or invalidate existing tokens on logout. Login request:</p> <p>``` POST /api/login HTTP/1.1 Host: machine.local:8090 Content-Length: 69</p> <p>{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;password-here&#34;,&#34;recaptcha&#34;:&#34;&#34;} ```</p> <p>The check found in the code `https://github.com/filebrowser/filebrowser/blob/master/http/auth.go` is not enough. There is no server-side blacklist or token invalidation on logout. Token renewal and validity only depends on expiry and user store timestamps:</p> <p>``` expired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour), true) updated := tk.IssuedAt != nil &amp;&amp; tk.IssuedAt.Unix() &lt; d.store.Users.LastUpdate(tk.User.ID…</p> https://cve.radiocsirt.org/vuln/ghsa-7xwp-2cpp-p8r7 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1