Name	SBA Research Cookie
Provider	SBA Research
Purpose	Saves the settings of the visitors selected in the cookie box.
Cookie name	sba-research-cookie
Cookie runtime	1 year

Name	YouTube
Provider	YouTube
Purpose	Used to unblock YouTube content.
Privacy policy	https://policies.google.com/privacy
Host(s)	google.com
Cookie name	NID
Cookie runtime	6 months

Name	Vimeo
Provider	Vimeo
Purpose	Used to unblock Vimeo content.
Privacy policy	https://vimeo.com/privacy
Host(s)	player.vimeo.com
Cookie name	vuid
Cookie runtime	2 years

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

July 24, 2025

Vulnerability Overview The Command Execution feature of Filebrowser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. Recommended Countermeasure We recommend to disable the… Read More

SBA Security Advisory – Filebrowser Stored Cross-Site Scripting (CVE-2025-52902)

July 24, 2025

Vulnerability Overview The Markdown preview function of Filebrowser v2.32.0 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Recommended Countermeasure We recommend to update to Filebrowser version 2.33.7… Read More

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

July 24, 2025

Vulnerability Overview URLs that are accessed by a user are commonly logged in many locations, both server- and client-side. It is thus good practice to never transmit any secret information as part of a URL. Filebrowser violates this practice, since access tokens are used as GET parameters. Read More

SBA Security Advisory – Filebrowser Insecure File Permissions (CVE-2025-52900)

July 24, 2025

Vulnerability Overview The file access permissions for files uploaded to or created from Filebrowser are never explicitly set by the application. The same is true for the database used by Filebrowser. On standard servers where the umask configuration has not been hardened before, this makes all the stated files readable… Read More

Bernhard Garn @ SPIQE 2025

July 16, 2025

Our colleague Bernhard Garn, researcher at SBA Research, gave a talk on "Improving the Security of Quantum Platforms using Combinatorial Methods" at the Workshop on Secure Protocol Implementations in the Quantum Era (SPIQE) on June 24th, in Munich, Germany. ... Read More

New article in Big Data and Cognitive Computing

July 8, 2025

Our colleagues Philip König, Sebastian Raubitzek, Dennis Toth, Fabian Obermann and Kevin Mallinger published a new paper on Boost-Classifier-Driven Fault Prediction Across Heterogeneous Open-Source Repositories. In this paper they analyzed over 2.4 million commits from 33 open-source projects… Read More

Young Researchers´ Day @ ICT Security Conference 2025 – Recap

July 2, 2025

A group of dedicated young researchers presented their work at the 21st ICT Security Conference on 25 and 26 June 2025, which was organized by the Austrian Armed Forces. They impressed the audience with their… Read More

Young Researchers´ Day @ ICT Security Conference 2025 – Recap

Second edition of sec4dev Dialogues brings insightful content and lively exchange

June 26, 2025

On June 17, SBA Research and its partner Condignum hosted the second edition of the sec4dev Dialogues event series. Security for Software Developers is essential. The current threat landscape and security incidents in recent years make it clear: the topic is more relevant than ever. This… Read More

SBA Security Advisory – Cyberduck and Mountain Duck – Weak Hash Algorithm for Certificate Fingerprint (CVE-2025-41256)

June 25, 2025

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate's fingerprint is stored as SHA-1, although SHA-1 is considered weak and should be replaced with SHA-256 or SHA-512. ... Read More

SBA Security Advisory – Cyberduck and Mountain Duck – Improper Certificate Store Handling (CVE-2025-41255)

June 25, 2025

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessary installing it to the Windows Certificate Store of the current user without any restrictions. This potentially allows attackers to bypass certificate-based authentication or authorization of other programs that trust this certificate store. ... Read More

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Upcoming Events:

Recent News:

SBA Security Advisory – Filebrowser Shell Commands Can Spawn Other Commands (CVE-2025-52903)

SBA Security Advisory – Filebrowser Stored Cross-Site Scripting (CVE-2025-52902)

SBA Security Advisory – Filebrowser Sensitive Data Transferred in URL (CVE-2025-52901)

SBA Security Advisory – Filebrowser Insecure File Permissions (CVE-2025-52900)

Bernhard Garn @ SPIQE 2025

New article in Big Data and Cognitive Computing

Young Researchers´ Day @ ICT Security Conference 2025 – Recap

Second edition of sec4dev Dialogues brings insightful content and lively exchange

SBA Security Advisory – Cyberduck and Mountain Duck – Weak Hash Algorithm for Certificate Fingerprint (CVE-2025-41256)

SBA Security Advisory – Cyberduck and Mountain Duck – Improper Certificate Store Handling (CVE-2025-41255)

SBA Newsletter

Upcoming events @ SBA

SBA Research at a glance

Highlights of the past years:

Privacy settings

SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Upcoming Events:

Recent News:

SBA Newsletter

Highlights of the past years:

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.