CVE-2025-53826 is a Critical severity session flaw (CVSS 9.8) in File Browser 2.39.0. It issues long-lived JWT tokens that stay valid after the user logs out. The record says no known patch existed at publication, so limit exposure and check the advisory for later changes.
What's affected
The record names File Browser version 2.39.0 as affected. At the time of publication, the record says, no known patches exist.
The repository page for the advisory also shows a banner saying that the repository was archived by its owner on 31 August 2026 and is now read-only. That is a sign that a fix may never arrive in that repository, so plan on that basis and check the project for any successor before you decide.
The issue is about how sessions end. A token that is copied once, from a browser, a log or a proxy, can be replayed later even if the person has logged out.
How to check if you're exposed
Find out which version you run, and where it is reachable:
filebrowser version
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i filebrowser
If you run 2.39.0, treat the tokens as risky. Check who can reach the service from outside, and whether it sits behind a reverse proxy that logs full request headers or tokens. Look at where tokens could have been copied: proxy logs, browser extensions, shared machines.
Then read the advisory again for updates, since the record states the patch status only as of its publication.
What to do now
- Read the advisory and the linked issue for any fix or workaround that appeared after publication.
- Rotate the signing key the service uses for tokens. That invalidates every token already issued, including ones stolen earlier.
- Put the service behind a VPN or an authenticating reverse proxy, so a stolen token alone is not enough to reach it.
- Remove tokens and Authorization headers from reverse proxy and application logs.
- Because the repository is archived, decide whether to move to a maintained alternative, and track the move as a dated task.
Why it matters
The record lists CWE-613 (insufficient session expiration), CWE-305 (authentication bypass by primary weakness) and CWE-385 (covert timing channel). The core point is the first one. Logging out is supposed to end a session, but a self contained JWT cannot be revoked by the server unless the server keeps a list of tokens it has cancelled.
Good designs combine short lived tokens with a way to refuse a token early, such as a denylist or a rotating key. The advisory describes the opposite, long lived tokens with no revocation, so logout changes the screen and not the access.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not describe attacks. The 9.8 score reflects network reach and the lack of any required privileges, and the practical fix is to reduce who can reach the service at all.
Quick check
Does logging out protect me?
Not on 2.39.0, per the advisory. The token stays valid after logout, so the logout button does not end access for anyone who has a copy.
Is there a fixed version?
The record says no known patch existed at publication. Check the advisory and the project for later changes, and note that the repository is now archived.
Sources
Last reviewed: 18 October 2026.
