{
 "id": "WPSEC-2026-1782",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1782/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1782/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1782/index.md",
 "title": "File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Limited Path Traversal to Sibling Directories via File and Folder Names",
 "description": "The File Manager Pro – Filester plugin for WordPress is vulnerable to limited Path Traversal in all versions up to, and including, 2.1.4, due to the elFinder local file system volume checking that a joined path stays inside the configured root with a string-prefix comparison that ignores directory boundaries. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with a restricted root folder, to create files and folders in, or move files into, sibling directories whose path begins with the same characters as that root. Files outside the root cannot be read this way.",
 "plugin": {
  "slug": "filester",
  "name": "File Manager Pro – Filester",
  "full_name": "File Manager Pro – Filester",
  "wordpress_org": "https://wordpress.org/plugins/filester/",
  "advisories_url": "https://wpsec.com/vuln/plugin/filester/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/filester"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.5",
 "remediation": "Update to 2.1.5 or later.",
 "fix_released": "2026-10-26T21:38:21+00:00",
 "published": "2026-10-27T21:48:09+00:00",
 "updated": "2026-10-27T13:39:48.299700+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1782/",
  "https://plugins.svn.wordpress.org/filester/tags/2.1.5/",
  "https://wordpress.org/plugins/filester/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/filester",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}