Vulnerabilities

TI-2022-19405 CVE-2022-40797 · GHSA-jpq9-fcx6-h2p8

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default…

HIGH 82

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04148 Published 2022-11-09 No fix listed CWE-434

TI-2019-14216 CVE-2019-19731 · GHSA-7frw-x8xq-rfcq

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

MEDIUM 46

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11617 Published 2019-12-16 No fix listed CWE-22

TI-2019-05091 CVE-2019-7174 · GHSA-63c7-44p3-428c

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File)…

MEDIUM 45

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01656 Published 2019-04-09 No fix listed

TI-2018-14554 CVE-2018-20526 · GHSA-jf88-mw32-x424

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

HIGH 80

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.73056 Published 2019-03-18 No fix listed CWE-434

TI-2018-14553 CVE-2018-20525 · GHSA-5f53-365x-h7hc

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

MEDIUM 59

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.21646 Published 2019-03-18 No fix listed CWE-22

TI-2018-08633 CVE-2018-12042 · GHSA-fx56-vgvx-jqgp

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

LOW 36

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01766 Published 2018-06-07 No fix listed CWE-22

Vulnerabilities

Filters

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default…

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File)…

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.