PatchTheCVEliquidfiles vulnerabilities and fixes
Recent CVEs affecting liquidfiles, with upgrade or downgrade steps. 3 tracked.
liquidfiles has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-09-30. Highest priority: CVE-2025-46093 (score 52/100).
- CVE-2025-56132 HIGH 7.3 UPGRADE LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality
- CVE-2025-46094 LOW 3.8 UPGRADE LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as
- CVE-2025-46093 CRITICAL 9.9 UPGRADE LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users
FAQ
How do I fix liquidfiles vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is liquidfiles being exploited right now?
None of the tracked liquidfiles CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which liquidfiles CVE should I patch first?
CVE-2025-46093 currently ranks highest (52/100): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users.