Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File)…
Priority MEDIUM 45Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.
Why it matters now
EPSS 0.01656 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:* | 1.4.5 | Vulnerable | Roxyfileman |
- cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Roxyfileman
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-7174
- 2026-10-03 Alias added: GHSA-63c7-44p3-428c
References
Exploit 1
More Roxyfileman Roxy Fileman vulnerabilities
- TI-2022-19405 Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default… CVSS 3.1CRITICAL 9.8
- TI-2018-14554 Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. CVSS 3.0CRITICAL 9.8
- TI-2018-14553 Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. CVSS 3.1CRITICAL 9.1
- TI-2019-14216 Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. CVSS 3.1HIGH 7.5
- TI-2018-08633 Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter. CVSS 3.0HIGH 7.5
Sources
- CVE-2019-7174 · CVE Program
- CVE-2019-7174 · NVD
- FIRST EPSS
- GHSA-63c7-44p3-428c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences