PT-2025-47521 · Unknown · Filecodebox

Published 2025-11-19 · Updated 2025-11-21 · CVE-2025-51661

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileCodeBox versions prior to 2.3

Description A path traversal issue exists in FileCodeBox that allows for arbitrary file writes. This occurs when the application is configured to use local filesystem storage. The SystemFileStorage.save file function within core/storage.py utilizes filenames from user input without proper validation to create the save path, leading to potential file writing outside the intended directory. Attackers can exploit this by sending crafted POST requests containing malicious traversal sequences to the /share/file/upload API endpoint. This endpoint does not require authorization, enabling remote attackers to perform arbitrary file writes.

Recommendations Update FileCodeBox to version 2.3 or later. As a temporary workaround, restrict access to the /share/file/upload API endpoint. Ensure proper validation of filenames received from user input before constructing file paths.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2025-51661

Affected Products

Filecodebox

References · 8

• 🔥 https://github.com/vastsa/FileCodeBox/issues/349 · Exploit
• https://osv.dev/vulnerability/CVE-2025-51661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51661 · Security Note
• https://github.com/vastsa/FileCodeBox · Note
• https://twitter.com/VulmonFeeds/status/1991373671995261153 · Twitter Post
• https://twitter.com/CVEnew/status/1991409489895911801 · Twitter Post
• https://t.me/cveNotify/143576 · Telegram Post
• https://t.me/CVEtracker/37779 · Telegram Post