CVE-2025-46094 Path traversal in LiquidFiles
Attackers can exploit directory traversal in LiquidFiles by configuring a local executable path as an Actionscript, potentially leading to unauthorized access or execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46094?
CVE-2025-46094 is a low-severity path traversal vulnerability in LiquidFiles, published on 4 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.
Weakness: CWE-24
Which versions are affected by CVE-2025-46094?
It affects 1 product.
Products include Liquidfiles Liquidfiles.
How do I fix CVE-2025-46094?
No fix has been published for CVE-2025-46094 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-46094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46094 exists.
Other vulnerabilities in LiquidFiles
- CVE-2025-46093 Privilege escalation in LiquidFiles
- CVE-2020-29071 Cross-site scripting in n/a
- CVE-2021-43397 LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
- CVE-2025-56132 Information disclosure in n/a
- CVE-2020-29072 Information disclosure in n/a
Sources
Also known as GHSA-77rv-vmxx-p9gp.