CVE-2025-53893
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-15

Last updated on: 2025-08-05

Assigner: GitHub, Inc.

Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint `Filebrowser-Server-IP:PORT/files/{file-name}` . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive. As of time of publication, no known patches are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-15
Last Modified
2025-08-05
Generated
2026-05-07
AI Q&A
2025-07-15
EPSS Evaluated
2026-05-05
NVD
CVE-2025-53893
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser 2.38.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a Denial of Service (DoS) issue in File Browser version 2.38.0. When an authenticated user uploads a large file, the server attempts to load the entire file content into memory during read operations without checking the file size or limiting resource usage. This uncontrolled memory consumption can crash the server and make it unresponsive.


How can this vulnerability impact me? :

The vulnerability can cause the File Browser server to crash and become unresponsive due to excessive memory consumption triggered by reading large files. This results in a Denial of Service, preventing legitimate users from accessing the file management interface and its functionalities.


What immediate steps should I take to mitigate this vulnerability?

Since no patches are available, immediate mitigation steps include restricting authenticated users from uploading large files, monitoring server memory usage closely to detect abnormal consumption, and limiting access to the file reading endpoint to trusted users only. Additionally, consider implementing external resource limits or using a proxy to block large file uploads or reads.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart