CVE-2025-0818mediumCWE-22

CVE-2025-0818: falha de média gravidade em File Manager Pro

Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar File Manager Pro+ Monitorar Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.0%
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
File Manager · File Manager Proninjateam · File Manager Pro – Filestersaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
CVEs relacionadas — File Manager Pro

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6846HIGHFile Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 15.9%CVE-2023-6825CRITICALFile Manager And File Manager Pro (Multiple Versions) - Directory TraversalEPSS 6.0%CVE-2024-8066HIGHFile Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.1%CVE-2024-9669HIGHFile Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File InclusionEPSS 1.0%CVE-2024-8126HIGHAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.9%CVE-2024-8704HIGHAdvanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_localeEPSS 0.9%