PatchTheCVECVE-2025-56132: LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality
CVE-2025-56132 is a high-severity flaw (CVSS 7.3) affecting liquidfiles. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | No |
| Weakness | CWE-305 |
| Published | 2025-09-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: LiquidFiles < 4.2 - User Enumeration via Password Reset
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-56132?
liquidfiles: upgrade to 4.2.0. Exact commands for each OS are on this page.
Is CVE-2025-56132 being exploited?
CVE-2025-56132 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-56132 affect?
CVE-2025-56132 affects liquidfiles. Severity is high (CVSS 7.3). LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to de
How urgent is CVE-2025-56132?
Priority 44/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-46094 LOW 3.8 UPGRADE LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as
- CVE-2025-46093 CRITICAL 9.9 UPGRADE LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users