CVE-2025-64523
BaseFortify
Publication date: 2025-11-12
Last updated on: 2026-02-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | to 2.45.1 (inc) |
| file_browser | file_browser | 2.45.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to breaches of data confidentiality agreements, which may negatively affect compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive data and proper access controls.
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in File Browser versions prior to 2.45.1. It affects the share deletion functionality, allowing any authenticated user with share permissions to delete other users' shared links without proper authorization checks.
How can this vulnerability impact me? :
The vulnerability can significantly impact users by enabling malicious actors to disrupt business operations through systematic removal of shared files and links. This can cause denial of service for legitimate users, potential data loss in collaborative environments, and breaches of data confidentiality agreements, affecting critical file sharing for projects, presentations, or document collaboration.
What immediate steps should I take to mitigate this vulnerability?
Upgrade File Browser to version 2.45.1 or later, as this version contains the fix for the Insecure Direct Object Reference (IDOR) vulnerability in the share deletion functionality. Additionally, restrict share deletion permissions to trusted users and monitor shared link deletions to detect any unauthorized activity.