Filemanager is vulnerable to Relative Path Traversal through filemanager.php

中危 6.5CVE-2025-46002 · GHSA-r7q6-6fmq-mx4c · Published 18/07/2025 · updated 17/06/2026

要点

CVE-2025-46002 是影响 simogeo/filemanager, filemanager (simogeo) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 66.3% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
simogeo/filemanager Packagist	`≤ 2.5.0`	No fix yet
filemanager simogeo	`≤ 2.0.0`	No fix yet

Description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

NVD description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

References

nvd.nist.gov/vuln/detail/CVE-2025-46002 · ADVISORY
simogeo/Filemanager · PACKAGE
simogeo/Filemanager release v1.7.0 · WEB
simogeo/Filemanager release v1.8.0 · WEB
simogeo/Filemanager release v2.0.0 · WEB
simogeo/Filemanager release v2.1.0 · WEB
simogeo/Filemanager release v2.2.0 · WEB
simogeo/Filemanager release v2.3.0 · WEB
zakumini/CVE-List · WEB
exploit-db.com/exploits/38945 · WEB

simogeo/filemanager 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

simogeo/filemanager

Packagist

≤ 2.5.0

No fix yet

filemanager

simogeo

≤ 2.0.0

No fix yet

Description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

NVD description

An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.