CVE-2025-46094
BaseFortify
Publication date: 2025-08-04
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liquidfiles | liquidfiles | to 4.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-24 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in LiquidFiles versions before 4.1.2 allows an attacker to perform a directory traversal attack by configuring the pathname of a local executable file as an Actionscript. This means an attacker could potentially access files or directories outside the intended scope by manipulating the file path.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to files or directories on the affected system, potentially exposing sensitive information or allowing limited manipulation of system files. However, the CVSS score indicates a low to medium impact with limited confidentiality and integrity impact and no availability impact.