RoxyfilemanCVEs & Vulnerabilities

6 CVEs affecting Roxyfileman products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

6 CVEs→ All vendors

Most Affected Products

roxy fileman 6

CVE-2022-40797CRITICAL

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

9 Nov 2022

9.8

CVSS

CVE-2019-19731HIGHpoc

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).

16 Dec 2019

7.5

CVSS

CVE-2019-7174CRITICAL

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

9 Apr 2019

9.8

CVSS

CVE-2018-20526CRITICALpoc

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

21 Mar 2019

9.8

CVSS

CVE-2018-20525CRITICALpoc

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

21 Mar 2019

9.1