Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: LiquidFiles Component: Liquidfiles Clear all filters
TI-2025-28931 CVE-2025-46094 · GHSA-77rv-vmxx-p9gp

Path traversal in LiquidFiles

Priority MEDIUM 51

LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00525 Published 2025-08-04 Fixed in 4.1.2 CWE-24
TI-2025-28930 CVE-2025-46093 · GHSA-x2r2-p764-47gc

Incorrect permission assignment in LiquidFiles

Priority HIGH 76

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00642 Published 2025-08-04 Fixed in 4.1.2 CWE-732
TI-2023-04058 CVE-2023-4393 · GHSA-67p3-vgwg-jfjf

HTML and SMTP Injection in LiquidFiles

Priority LOW 27

HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00353 Published 2023-10-29 No fix listed CWE-116