CVE-2025-51661
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-24
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lanol | filecodebox | to 2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-24 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in FileCodeBox v2.2 and earlier. It allows remote attackers to write arbitrary files to the system by exploiting the save_file method, which uses user-supplied filenames without validation. Attackers can send specially crafted POST requests with malicious path traversal sequences to the /share/file/upload endpoint, which does not require authorization, enabling them to write files outside the intended directory.
How can this vulnerability impact me? :
The vulnerability can allow attackers to write arbitrary files anywhere on the server's filesystem, potentially leading to unauthorized data modification, system compromise, or the introduction of malicious files. Since the upload endpoint does not require authorization, attackers can exploit this remotely without credentials, increasing the risk of system integrity breaches.