File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Limited Path Traversal to Sibling Directories via File and Folder Names
- ID
- WPSEC-2026-1782
- Plugin
- File Manager Pro – Filester (filester)
- Affected
- all versions before 2.1.5
- Remediation
- Update to 2.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- File Manager Pro – Filester on WPSec AttackSurface
- Fix released
- Published
Description
The File Manager Pro – Filester plugin for WordPress is vulnerable to limited Path Traversal in all versions up to, and including, 2.1.4, due to the elFinder local file system volume checking that a joined path stays inside the configured root with a string-prefix comparison that ignores directory boundaries. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with a restricted root folder, to create files and folders in, or move files into, sibling directories whose path begins with the same characters as that root. Files outside the root cannot be read this way.
References
- https://wpsec.com/vuln/WPSEC-2026-1782/
- https://plugins.svn.wordpress.org/filester/tags/2.1.5/
- https://wordpress.org/plugins/filester/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS