JVN#12884935: FileZen vulnerable to directory traversal

FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface.
FileZen contains a directory traversal vulnerability (CWE-22).

Impact

A remote attacker may upload an arbitrary file in the specific directory in the product.
If a specialy crafted file is uploaded by an attacker, it may lead to an arbitrary OS command execution.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
According to the developer, this vulnerability has been already addressed in V4.2.3 released on January 30, 2019.
In addition, the possible arbitrary OS command execution issue has been addressed in the following versions.

• V4.2.6 (Released on December 7, 2020)
• V5.0.1 (Released on December 9, 2020)

Products Affected

• FileZen versions from V3.0.0 to V4.2.2