EUVD-2026-38111
GHSA-pmp7-7j9c-794v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H for required secondary domain Admin credentials; S:C because escalation crosses from domain-scoped to system-wide authorization, with full C/I/A Sysadmin impact.
Primary rating from Vendor (PRJBLK).
CVSS VectorVendor: PRJBLK
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group.
AnalysisAI
Privilege escalation in LiquidFiles before 4.2.12 allows an authenticated Admin of a secondary (non-default) domain to elevate to full Sysadmin access by manipulating group settings within their managed secondary domain group. This broken access control flaw (CWE-285) collapses the authorization boundary between domain-scoped Admin and system-wide Sysadmin roles, granting an attacker complete platform control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) valid Admin-level credentials for a secondary (non-default) LiquidFiles domain - regular user accounts and primary domain accounts are not sufficient; (2) the target LiquidFiles instance must be configured with at least one secondary (non-default) domain, as the vulnerable code path is specific to non-default domain group management; (3) the attacker must be able to reach the LiquidFiles web interface over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N) scores 5.9 Medium, reflecting that while network-accessible, exploitation requires high existing privileges (PR:H) and a specific deployment configuration (AT:P - secondary domain setup). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding valid Admin credentials for a secondary domain - whether through credential theft, insider access, or social engineering - authenticates to the LiquidFiles web interface and uses the group management feature to modify their managed secondary domain group in a way that triggers the broken authorization check, elevating their session to Sysadmin. With Sysadmin access, the attacker gains unrestricted access to all files, users, and system configuration across every domain. … |
| Remediation | Upgrade to LiquidFiles 4.2.12 or later, which is the vendor-released patch confirmed by the release notes at https://docs.liquidfiles.com/release_notes/version_4-2-x.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Liquidfiles
View allAn XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. Rated critical severity (CVSS 9.0), this vuln
LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin. Rat
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. Rated hig
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. Rated medium severity (CVSS 6.1), th
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrat
HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform
LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actions
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execut
Same weakness CWE-285 – Improper Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today