PT-2025-6806 · Saadiqbal+3 · Advanced File Manager – Ultimate Wp File Manager/Document Library Solution+3

Kevin Wydler · Published 2025-02-12 · Updated 2025-08-15 · CVE-2025-0818

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: elFinder versions prior to 2.1.65

Description: Several WordPress plugins utilizing elFinder are susceptible to Directory Traversal, allowing unauthenticated attackers to delete arbitrary files. Exploitation requires the site owner to make an instance of the file manager accessible to users.

Recommendations: Update elFinder to version 2.1.65 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-0818

Affected Products

Advanced File Manager – Ultimate Wp File Manager/Document Library Solution

File Manager

File Manager Pro

File Manager Pro – Filester

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2025-0818 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0818 · Vendor Advisory
• https://github.com/Studio-42/elFinder · Note
• https://github.com/Studio-42/elFinder/blob/master/php/elFinder.class.php#L5367 · Note
• https://t.me/cvedetector/17916 · Telegram Post
• https://twitter.com/f8sbrightermind/status/1955502235577729128 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3335715/file-manager-advanced/trunk/application/library/php/elFinder.class.php · Note
• https://t.me/CVEtracker/29858 · Telegram Post
• https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/lib/php/elFinder.class.php#L5378 · Note
• https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/lib/php/elFinder.class.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b?source=cve · Note
• https://t.me/cveNotify/132001 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3319016/filester · Note
• https://twitter.com/VulmonFeeds/status/1955570120060747901 · Twitter Post
• https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/library/php/elFinder.class.php#L5411 · Note