Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server...
9.8CVSS
9.6AI Score
0.056EPSS
7.5CVSS
7.5AI Score
0.002EPSS
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder...
7.5CVSS
7.8AI Score
0.041EPSS
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File)...
9.8CVSS
9.4AI Score
0.007EPSS
9.1CVSS
8.3AI Score
0.056EPSS
9.8CVSS
9.4AI Score
0.007EPSS