High severity · published Aug 4, 2025
CVE-2025-46093
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LiquidFiles · LiquidFiles
before 4.1.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46093
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46093
Release Notes
https://docs.liquidfiles.com/release_notes/version_4-1-x.html
Third Party Advisory
https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea
Exploit
https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/
More from LiquidFiles
9.0
CVE-2020-29071
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19
8.8
CVE-2021-43397
LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin
7.3
CVE-2025-56132
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality
6.1
CVE-2023-4393
HTML and SMTP Injection in LiquidFiles
6.1
CVE-2020-29072
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19