Critical
CVSS 9.8
Overview
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2025-46001
An arbitrary file upload vulnerability in the is_allowed_file_type() function of...
Risk analysis
This vulnerability is rated 🔴 CRITICAL.
- CVSS: 9.8 (CRITICAL)
- Detected tags: rce, upload (tag impact: VERY HIGH)
Recommended actions:
- Patch/upgrade immediately (remote code execution).
- Reduce exposure (WAF/segmentation), minimize attack surface.
- Restrict types/MIME, store outside web root, inspect content.