BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-11-24

Assigner: MITRE

Description

A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.save_file method in core/storage.py uses filenames from user input without validation to construct save_path and save files. This allows remote attackers to perform arbitrary file writes outside the intended directory by sending crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-19

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-51661

Affected Vendors & Products

Vendor	Product	Version / Range
lanol	filecodebox	to 2.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-24	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in FileCodeBox v2.2 and earlier. It allows remote attackers to write arbitrary files to the system by exploiting the save_file method, which uses user-supplied filenames without validation. Attackers can send specially crafted POST requests with malicious path traversal sequences to the /share/file/upload endpoint, which does not require authorization, enabling them to write files outside the intended directory.

Impact Analysis

The vulnerability can allow attackers to write arbitrary files anywhere on the server's filesystem, potentially leading to unauthorized data modification, system compromise, or the introduction of malicious files. Since the upload endpoint does not require authorization, attackers can exploit this remotely without credentials, increasing the risk of system integrity breaches.

Hi! I’m here to help you understand CVE-2025-51661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70