CVE-2024-25153
CRITICALFileCatalyst Workflow Web Portal - Path Traversal
Title source: llmDescription
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.
Exploits (2)
Scores
CVSS v3
9.8
EPSS
0.8222
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-472
CWE-668
Status
published
Products (2)
fortra/filecatalyst_workflow
5.1.6 build112
fortra/filecatalyst_workflow
5.0 - 5.1.6
Published
Mar 13, 2024
Tracked Since
Feb 18, 2026