6.5
CVE-2025-0818
- EPSS 1.58%
- Published 13.08.2025 03:42:04
- Last modified 13.08.2025 17:33:46
- Source security@wordfence.com
- Teams watchlist Login
- Open Login
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Vendorninjateam
≫
Product
File Manager Pro – Filester
Default Statusunaffected
Version <=
1.8.9
Version
*
Status
affected
Vendorsaadiqbal
≫
Product
Advanced File Manager – Ultimate WP File Manager And Document Library Solution
Default Statusunaffected
Version <=
5.3.6
Version
*
Status
affected
Vendormndpsingh287
≫
Product
File Manager
Default Statusunaffected
Version <=
8.4.2
Version
*
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.58% | 0.81 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| security@wordfence.com | 6.5 | 2.2 | 4.2 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.