7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52902

CVE-2025-52902: filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary

The Markdown preview function of File Browser v2.32.0 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser

Impact

A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed.

Malicious actions that are possible include:

Obtaining a user's session token
Elevating the attacker's privileges, if the victim is an administrator (e.g., gaining command execution rights)

Vulnerability Description

Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called xss.md with the following content:

# Hallo

<b>foo</b>

<img src="xx" onerror=alert(9)>
<i>bar</i>

Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the onerror event handler.

Proof of Concept

The screenshot shows that the code from the file mentioned above has actually been executed in the victim's browser:

JavaScript code being executed in the Markdown Preview

Recommended Countermeasures

The most thorough fix would be to reconfigure the application's Markdown parser to ignore all HTML elements and only render rich text which is part of the Markdown specification. If HTML rendering is considered to be a required feature, an HTML sanitizer like DOMPurify should be used, preferably in conjunction with a Content Security Policy (CSP).

Timeline

2025-03-25 Identified the vulnerability in version 2.32.0
2025-04-11 Contacted the project
2025-04-18 Vulnerability disclosed to the project
2025-06-25 Uploaded advisories to the project's GitHub repository
2025-06-26 CVE ID assigned by GitHub
2025-06-26 Fix released with version 2.33.7

References

DOMPurify

Credits

Mathias Tausig (SBA Research)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52902

CVE-2025-52902:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser/v2	go	< 2.33.7	2.33.7
github.com/filebrowser/filebrowser	go	<= 1.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) issue within the Markdown preview feature of the filebrowser's frontend. The root cause is the failure to sanitize user-provided content before rendering it as HTML.

My analysis of the provided commit f19943a42e8e092e811dffbe9f4623dac36f1f0d pinpoints the exact location of the flaw. The patch modifies frontend/src/views/files/Editor.vue, a Vue.js component.

The key change is within the onMounted lifecycle hook. This function is triggered when the editor component is displayed. Before the patch, the code previewContent.value = await marked(new_value); took the content of a file, converted it from Markdown to HTML using the marked library, and directly assigned it to the previewContent variable, which is then rendered in the UI. The marked library, by design, can output raw HTML, including malicious scripts if they are present in the input Markdown file.

The fix introduces DOMPurify, a trusted HTML sanitizer. The vulnerable line is replaced with previewContent.value = DOMPurify.sanitize(await marked(new_value));. This ensures that any potentially harmful elements or attributes in the generated HTML are removed before the content is displayed to the user, effectively neutralizing the XSS threat.

Therefore, the anonymous function within the onMounted hook of the Editor.vue component is the vulnerable function. It processes untrusted input (the file content) and sends it to a dangerous sink (the HTML renderer) without proper validation or sanitization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-52902: filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary

Impact

Vulnerability Description

Proof of Concept

Recommended Countermeasures

Timeline

References

Credits

CVE-2025-52902:

7.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.6

7.6

Basic Information

Basic Information

CVE-2025-52902: filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary

Impact

Vulnerability Description

Proof of Concept

Recommended Countermeasures

Timeline

References

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI