Roxyfileman: >> Roxy Fileman Security Vulnerabilities
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)
CVSS Score
9.8
EPSS Score
0.083
Published
2022-11-09
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).
CVSS Score
7.5
EPSS Score
0.254
Published
2019-12-16
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.
CVSS Score
9.8
EPSS Score
0.004
Published
2019-04-09
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
CVSS Score
9.1
EPSS Score
0.329
Published
2019-03-21
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
CVSS Score
9.8
EPSS Score
0.834
Published
2019-03-21
Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.
CVSS Score
7.5
EPSS Score
0.006
Published
2018-06-07