PT-2025-40021 · Unknown · Liquidfiles

Published 2025-09-30 · Updated 2026-01-25 · CVE-2025-56132

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 4.2

Description LiquidFiles filetransfer server is susceptible to a user enumeration issue within its password reset functionality. The application provides differing responses for valid and invalid email addresses, enabling unauthenticated attackers to ascertain the existence of user accounts. While version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attempts, user enumeration remains possible by default. Prior to version 4.2, only basic IP-based rate limiting was implemented, which can be circumvented by distributing requests across multiple IP addresses, effectively bypassing both login and password reset security controls. Successful exploitation allows attackers to enumerate valid email addresses associated with the application, potentially leading to subsequent attacks like password spraying.

Recommendations LiquidFiles versions prior to 4.2: Upgrade to version 4.2 or later.

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2025-56132

Affected Products

Liquidfiles

References · 8

• https://osv.dev/vulnerability/CVE-2025-56132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56132 · Security Note
• https://twitter.com/CVEnew/status/2003567331797094403 · Twitter Post
• https://t.me/CVEtracker/33757 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2015243253407486134 · Twitter Post
• https://docs.liquidfiles.com/release_notes/version_4-2-x.html · Note
• https://twitter.com/transilienceai/status/2015266250180722724 · Twitter Post
• https://liquidfiles.com/updates/v4.2.html · Note