Bernhard Garn @ 2nd IRDR Young Scientists Lumos

July 29, 2025

In June, our colleague Bernhard Garn, senior researcher at SBA Research, participated in the 2nd IRDR Young Scientists Lumos, a global pre-event to the 2025 Global Platform for Disaster Risk Reduction (GPDRR). Co-hosted by the Integrated Research on Disaster Risk (IRDR) and the… Read More

“Best of the Best”-Award for Kevin Mallinger, Gabriel Gegenhuber, and Edgar Weippl

July 24, 2025

We are proud to announce that this year, three members of SBA Research have been recognized for their outstanding contributions! Each year, the University of Vienna honors exceptional accomplishments by affiliated researchers through its “Best of the Best” awards. The recognition focuses on two main categories:… Read More

“Best of the Best”-Award for Kevin Mallinger, Gabriel Gegenhuber, and Edgar Weippl

SBA Security Advisory – Filebrowser Insecure Password Handling (CVE-2025-52997)

July 24, 2025

Vulnerability Overview All user accounts authenticate towards a Filebrowser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Recommended Countermeasure We recommend to update to Filebrowser version 2.34.1 or later and configure… Read More

SBA Security Advisory – Filebrowser Password Protection of Links Bypassable (CVE-2025-52996)

July 24, 2025

Vulnerability Overview Files managed by Filebrowser can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible. Recommended Countermeasure We recommend to update to… Read More

SBA Security Advisory – Filebrowser Command Execution Allowlist Bypass (CVE-2025-52995)

July 24, 2025

Vulnerability Overview The Command Execution feature of Filebrowser only allows the execution of shell commands which have been predefined on a user-specific allowlist. The implementation of this allowlist is erroneous, allowing a user to execute additional commands not permitted. Recommended Countermeasure We recommend to update… Read More

SBA Security Advisory – Filebrowser Command Execution not Limited to Scope (CVE-2025-52904)

July 24, 2025

Vulnerability Overview In the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access… Read More

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

July 24, 2025

Vulnerability Overview The Command Execution feature of Filebrowser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. Recommended Countermeasure We recommend to disable the… Read More

SBA Security Advisory – Filebrowser Stored Cross-Site Scripting (CVE-2025-52902)

July 24, 2025

Vulnerability Overview The Markdown preview function of Filebrowser v2.32.0 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Recommended Countermeasure We recommend to update to Filebrowser version 2.33.7… Read More

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

July 24, 2025

Vulnerability Overview URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. Filebrowser violates this practice, since access tokens are used as GET parameters. Read More

SBA Security Advisory – Filebrowser Insecure File Permissions (CVE-2025-52900)

July 24, 2025

Vulnerability Overview The file access permissions for files uploaded to or created from Filebrowser are never explicitly set by the application. The same is true for the database used by Filebrowser. On standard servers where the umask configuration has not been hardened before, this makes all the stated files readable… Read More

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Upcoming Events:

Recent News:

Bernhard Garn @ 2nd IRDR Young Scientists Lumos

“Best of the Best”-Award for Kevin Mallinger, Gabriel Gegenhuber, and Edgar Weippl

SBA Security Advisory – Filebrowser Insecure Password Handling (CVE-2025-52997)

SBA Security Advisory – Filebrowser Password Protection of Links Bypassable (CVE-2025-52996)

SBA Security Advisory – Filebrowser Command Execution Allowlist Bypass (CVE-2025-52995)

SBA Security Advisory – Filebrowser Command Execution not Limited to Scope (CVE-2025-52904)

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

SBA Security Advisory – Filebrowser Stored Cross-Site Scripting (CVE-2025-52902)

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

SBA Security Advisory – Filebrowser Insecure File Permissions (CVE-2025-52900)

SBA Newsletter

Upcoming events @ SBA

SBA Research at a glance

Highlights of the past years:

SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Upcoming Events:

Recent News:

SBA Newsletter

Highlights of the past years:

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.