CVE-2024-25153 — Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially…
Published: 2024-03-13 · CVSS: 9.8 · CVSS 3.1
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7