CVE-2025-46093

HIGH 8.8CVE-2025-46093 · Published 04/08/2025 · updated 17/06/2026

In short

CVE-2025-46093 is a HIGH (CVSS 8.8) vulnerability affecting liquidfiles (liquidfiles).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.7% of all vulnerabilities.
Fix: update to 4.1.2 or later.

Package	Affected versions	Patched versions
liquidfiles liquidfiles	`< 4.1.2`	`4.1.2`

Description

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

References

docs.liquidfiles.com/release_notes/version_4-1-x.html · Release Notes
gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea · Third Party Advisory
projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce · Exploit

More vulnerabilities in liquidfiles

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

liquidfiles

< 4.1.2

4.1.2

More vulnerabilities in liquidfiles

See all →