Paper/Archive/CVE-2025-46093

CVE-2025-46093

LiquidFiles LiquidFiles — LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code…

EPSS 0.6%public exploit CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 48.6.486 × 209.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

Affected

ProductAffectedFixed inSource

LiquidFiles< 4.1.24.1.2CNA

Scores by source

mitre (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refdocs.liquidfiles.com/release_notes/version_4-1-x.html exploitprojectblack.io/blog/liquidfiles-vulnerability-authenticated-rce refgist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea