Vulnerability · Published Aug 4, 2025 · Assigned by mitre
CVE-2025-46093
Critical 9.9
In plain English
A critical-severity incorrect permission assignment in LiquidFiles from LiquidFiles. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LiquidFiles | LiquidFiles | 0 – before 4.1.2 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H