LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.
References
| Link | Resource |
|---|---|
| https://docs.liquidfiles.com/release_notes/version_4-1-x.html | Release Notes |
| https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea | Third Party Advisory |
| https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/ | Exploit Third Party Advisory |
| https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/ | Exploit Third Party Advisory |
Configurations
History
07 Aug 2025, 14:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Liquidfiles liquidfiles
Liquidfiles |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:* | |
| References | () https://docs.liquidfiles.com/release_notes/version_4-1-x.html - Release Notes | |
| References | () https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea - Third Party Advisory | |
| References | () https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/ - Exploit, Third Party Advisory |
05 Aug 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
04 Aug 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-04 23:15
Updated : 2025-08-07 14:29
NVD link : CVE-2025-46093
Mitre link : CVE-2025-46093
JSON object : View
Products Affected
liquidfiles
- liquidfiles
CWE
No CWE.