CVE-2025-46093

CRITICAL

Liquidfiles < 4.1.2 - Incorrect Permission Assignment

Title source: rule
STIX 2.1

Description

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

References (3)

Scores

CVSS v3 9.9
EPSS 0.0019
EPSS Percentile 40.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-732
Status published
Products (1)
liquidfiles/liquidfiles < 4.1.2
Published Aug 04, 2025
Tracked Since Feb 18, 2026