CVE-2025-46093 Privilege escalation in LiquidFiles
Attackers can gain root privileges and execute arbitrary code by exploiting insecure FTP permissions and sudoers configuration in LiquidFiles.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46093?
CVE-2025-46093 is a critical vulnerability in LiquidFiles, published on 4 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.
Weakness: CWE-732
Which versions are affected by CVE-2025-46093?
It affects 1 product.
Products include Liquidfiles Liquidfiles.
How do I fix CVE-2025-46093?
No fix has been published for CVE-2025-46093 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-46093 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46093 exists.
Other vulnerabilities in LiquidFiles
- CVE-2020-29071 Cross-site scripting in n/a
- CVE-2021-43397 LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
- CVE-2025-56132 Information disclosure in n/a
- CVE-2020-29072 Information disclosure in n/a
- CVE-2023-4393 HTML and SMTP Injection in LiquidFiles
Sources
Also known as GHSA-x2r2-p764-47gc.