CVE-2025-51661
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
75/100
Published: 2025-11-19
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.save_file method in core/storage.py uses filenames from user input without validation to construct save_path and save files. This allows remote attackers to perform arbitrary file writes outside the intended directory by sending crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any authorization.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| lanol | filecodebox | < 2.2 |
References & Advisories (2)
Product
Exploit
Issue Tracking