Read the docs

LiquidFiles

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

LiquidFiles records in CISA KEV

No LiquidFiles vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Liquidfiles 8 records HIGH

Records

9 records

TI-2025-28930 CVE-2025-46093 · GHSA-x2r2-p764-47gc

Incorrect permission assignment in LiquidFiles

Priority HIGH 76

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00642 Published 2025-08-04 Fixed in 4.1.2 CWE-732
TI-2026-10841 CVE-2026-12673 · GHSA-pmp7-7j9c-794v

Improper authorization in liquidfiles

Priority MEDIUM 60

Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00403 Published 2026-06-20 Fixed in 4.2.12 CWE-285
TI-2025-28931 CVE-2025-46094 · GHSA-77rv-vmxx-p9gp

Path traversal in LiquidFiles

Priority MEDIUM 51

LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00525 Published 2025-08-04 Fixed in 4.1.2 CWE-24
TI-2023-04058 CVE-2023-4393 · GHSA-67p3-vgwg-jfjf

HTML and SMTP Injection in LiquidFiles

Priority LOW 27

HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00353 Published 2023-10-29 No fix listed CWE-116
Open these records in search →