CVE-2025-46093

CriticalPublic PoC

Published: 04 August 2025

Published

04 August 2025

Modified

07 August 2025

KEV Added

—

Patch

—

CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0019 40.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-46093 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Liquidfiles Liquidfiles. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Patching LiquidFiles to version 4.1.2 or later removes support for FTP SITE CHMOD mode 6777, directly preventing the privilege escalation to root via setuid/setgid.

AC-6 Least Privilege good match

prevent

Least privilege enforcement restricts FTPDrop users from performing actions that set setuid/setgid permissions, blocking the path to arbitrary root code execution.

AC-3 Access Enforcement partial match

prevent

Access enforcement prevents unauthorized logical access operations like SITE CHMOD 6777 that enable exploitation through Actionscript and sudoers.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1548.001 Setuid and Setgid Privilege Escalation

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

attack.mitre.org →

T1548.003 Sudo and Sudo Caching Privilege Escalation

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.

attack.mitre.org →

Why these techniques?

Vuln enables RCE+priv esc via setuid/setgid chmod abuse on public-facing FTP app combined with sudoers misconfig.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

Deeper analysisAI

CVE-2025-46093 is a critical vulnerability in LiquidFiles versions prior to 4.1.2, stemming from improper permission handling classified under CWE-732. The issue arises because the software supports the FTP SITE CHMOD command for mode 6777, which enables setuid and setgid permissions. This misconfiguration allows exploitation through the Actionscript feature combined with the system's sudoers setup, leading to unauthorized privilege escalation.

An authenticated attacker with low privileges, specifically an FTPDrop user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants the ability to execute arbitrary code with root privileges, resulting in complete compromise of the system, including high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Mitigation is addressed in LiquidFiles version 4.1.2 and later, as detailed in the vendor's release notes for the 4.1.x series. Security advisories and analyses, including those from ProjectBlack and a related GitHub Gist, confirm the vulnerability as an authenticated remote code execution issue and provide further technical details on the exploit mechanism. Administrators should upgrade to the patched version immediately.