PT-2025-30041 · Unknown · File Manager

Hahwul + 1 · Published 2025-07-18 · Updated 2025-07-18 · CVE-2025-46001

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Filemanager version 2.3.0

Description An arbitrary file upload vulnerability exists in the is allowed file type() function. This allows attackers to execute arbitrary code by uploading a crafted PHP file.

Recommendations Filemanager version 2.3.0: Address the issue by securing the file upload process and validating file types to prevent the execution of arbitrary code. As a temporary workaround, consider restricting file uploads to authorized users only.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46001

GHSA-M5HW-RHVR-F47C

Affected Products

File Manager

References · 10

• 🔥 https://exploit-db.com/exploits/38895 · Exploit
• 🔥 https://github.com/zakumini/CVE-List/blob/main/CVE-2025-46001/CVE-2025-46001.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46001 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m5hw-rhvr-f47c · Vendor Advisory
• https://github.com/simogeo/Filemanager · Note
• https://twitter.com/VulmonFeeds/status/1946221743325970482 · Twitter Post
• https://t.me/cvenotify/129445 · Telegram Post
• https://t.me/cvetracker/28138 · Telegram Post
• https://twitter.com/CVEnew/status/1946207143675277757 · Twitter Post