CVE-2023-5907
Medium
Description
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
SeverityMedium
CVSS6.5
Exploit probability—
ProductBitapps File Manager
PublishedDec 11, 2023
First seenDec 11, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- bitapps file_manager6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitapps file_manager | v < 6.3 | 6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.