CVE-2025-46093

critical · 9.9

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

9.9

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2025-08-04

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-732

Affected products

Vendor	Product	Affected versions
liquidfiles	liquidfiles	< 4.1.2

Check a specific version with /api/v1/cve/match.

References

https://docs.liquidfiles.com/release_notes/version_4-1-x.html
https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea
https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/
https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-46093