CVE-2025-6152: Medium Path Traversal in Steel Browser

CVE-2025-6152 is a medium (CVSS 6.3) path traversal in Steel Browser up to 0.1.3. The handleFileUpload function in the files routes trusts the filename argument, so a crafted name can reach outside the upload folder. The record names a patch commit and says to apply it; confirm the release that carries it.

What's affected

• Product: Steel Browser, a browser automation project.
• Affected: versions up to 0.1.3.
• Vulnerable code: the handleFileUpload function in api/src/modules/files/files.routes.ts, through the filename argument.
• Weakness: CWE-22, path traversal.
• Fixed: the record says the patch is commit 7ba93a10000fb77ee01731478ef40551a27bd5b9 and recommends applying it. It does not name a release number, so check the project releases for the first version that includes the commit.
• CVSS 3.1: 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. A low-privilege account is needed.
• Public exploit: the record does not say one exists. It is not on the CISA KEV list.

How to check if you're exposed

Check the version of Steel Browser you run. For a container, look at the image tag. For a source checkout, look at the package file and the git history:

docker image ls | grep -i steel
git log --oneline | grep 7ba93a1
grep '"version"' package.json

If the patch commit is not in your history, or the version is 0.1.3 or lower, treat the deployment as affected.

Then check who can reach the API. The vulnerable route handles file uploads, and the vector needs a low-privilege account, so a shared or internet-facing instance carries more risk than a local developer tool. Check the upload directory for files you did not expect, and look in the API logs for upload requests whose filenames contain parent directory sequences.

What to do now

1. Find every Steel Browser deployment and note the version or image tag.
2. Update to a release that contains commit 7ba93a10000fb77ee01731478ef40551a27bd5b9. If you build from source, pull the commit.
3. Limit network access to the Steel Browser API to the services that need it, and require authentication.
4. Run the service as a non-root user with write access only to its intended upload folder.
5. Review the upload folder and its parent directories for unexpected files.
6. Add the project to a regular dependency check using the free in-browser dependency scan.

Why it matters

Path traversal (CWE-22) is what happens when a program joins a user-supplied filename onto a folder path without checking the result stays inside that folder. A name that climbs up the directory tree can then write or read somewhere unintended.

Upload handlers are a frequent place for it. The safe approach is to ignore the name the client sends, generate your own file name, or resolve the final path and confirm it still starts with the intended directory.

The score is medium because a login is needed and the impact metrics are rated low. For a service that automates browsers, though, unexpected file writes can matter more than the number suggests, because the process may run next to sensitive profiles and credentials.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-6152
• Steel Browser record references (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.