Filemanager is vulnerable to Relative Path Traversal through filemanager.php

MEDIO 6.5CVE-2025-46002 · GHSA-r7q6-6fmq-mx4c · Published 18/07/2025 · updated 17/06/2026

In breve

CVE-2025-46002 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda simogeo/filemanager, filemanager (simogeo).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
simogeo/filemanager Packagist	`≤ 2.5.0`	No fix yet
filemanager simogeo	`≤ 2.0.0`	No fix yet

Description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

NVD description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

References

nvd.nist.gov/vuln/detail/CVE-2025-46002 · ADVISORY
simogeo/Filemanager · PACKAGE
simogeo/Filemanager release v1.7.0 · WEB
simogeo/Filemanager release v1.8.0 · WEB
simogeo/Filemanager release v2.0.0 · WEB
simogeo/Filemanager release v2.1.0 · WEB
simogeo/Filemanager release v2.2.0 · WEB
simogeo/Filemanager release v2.3.0 · WEB
zakumini/CVE-List · WEB
exploit-db.com/exploits/38945 · WEB

Altre vulnerabilità di simogeo/filemanager

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2025-46002 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda simogeo/filemanager, filemanager (simogeo).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.3% delle vulnerabilità.

Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package

Affected versions

Patched versions

simogeo/filemanager

Packagist

≤ 2.5.0

No fix yet

filemanager

simogeo

≤ 2.0.0

No fix yet

Description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

NVD description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.