CVE-2025-46093 | LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 67… | CVSS 9.9 CRITICAL

Description

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

Metadata

CVE ID: CVE-2025-46093
State: PUBLISHED
Assigner: mitre
Reserved: 2025-04-22 00:00 UTC
Published: 2025-08-04 00:00 UTC
Last updated: 2025-08-05 16:22 UTC
Primary CWE: CWE-732
CWE-732 Incorrect Permission Assignment for Critical Resourc…
Vendor / Product: LiquidFiles / LiquidFiles
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
LiquidFiles	LiquidFiles	—	0 < 4.1.2

Weakness (CWE)

CWE	Source	Description
CWE-732	cna	CWE-732 Incorrect Permission Assignment for Critical Resource

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (3)