CVE-2025-51661: Path Traversal
A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.savefile method in core/storage.py uses filenames from user input without validation to construct savepath and save files. This allows remote attackers to perform arbitrary file writes outside the intended directory by sending crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any authorization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-51661?
CVE-2025-51661 is classified as a path traversal vulnerability with a high severity due to its potential for arbitrary file writes.
How do I fix CVE-2025-51661?
To fix CVE-2025-51661, ensure that user input for file names is properly validated and sanitized before being used to construct file paths.
Which versions of FileCodeBox are affected by CVE-2025-51661?
CVE-2025-51661 affects FileCodeBox version 2.2 and earlier.
What is a path traversal vulnerability as explained in CVE-2025-51661?
A path traversal vulnerability allows attackers to access files and directories outside the intended directory by manipulating file paths.
Who is the vendor for the software affected by CVE-2025-51661?
The vendor for the affected software is Lanol, specifically for the product FileCodeBox.