PT-2025-31874 · Unknown · Liquidfiles

Nikolai0X · Published 2025-08-04 · Updated 2025-08-05 · CVE-2025-46093

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 4.1.2

Description LiquidFiles versions prior to 4.1.2 support FTP SITE CHMOD for mode 6777 (setuid and setgid). This allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

Recommendations Update LiquidFiles to version 4.1.2 or later.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-46093

Affected Products

Liquidfiles

References · 9

• 🔥 https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46093 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46093 · Vendor Advisory
• https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea · Note
• https://t.me/CVEtracker/29139 · Telegram Post
• https://twitter.com/CveFindCom/status/1952500023620423789 · Twitter Post
• https://docs.liquidfiles.com/release_notes/version_4-1-x.html · Note
• https://twitter.com/CVEnew/status/1952500635842019610 · Twitter Post
• https://t.me/cveNotify/130856 · Telegram Post