Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how roxyfileman compares to other vendors in security performance

View Risk Score →

Roxyfileman Roxy FilemanMalicious File Upload

Risk 86
Severity
9.8
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDENUPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

First published (updated )
CVE-2022-40797

Roxyfileman Roxy FilemanRoxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka …

Risk 86
Severity
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

First published (updated )
CVE-2019-7174

Roxyfileman Roxy FilemanPath Traversal

Risk 43
Severity
7.5
Path Traversal
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

First published (updated )
CVE-2018-12042

Roxyfileman Roxy FilemanPath Traversal

Risk 66
Severity
9.1
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

First published (updated )
CVE-2018-20525

Roxyfileman Roxy FilemanMalicious File Upload

Risk 86
Severity
9.8
Malicious File Upload
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

First published (updated )
CVE-2018-20526

Roxyfileman Roxy FilemanPath Traversal

Risk 43
Severity
7.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).

First published (updated )
CVE-2019-19731

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203