# File Manager Pro – Filester <= 2.1.4 - Authenticated (Subscriber+) Limited Path Traversal to Sibling Directories via File and Folder Names

- **ID:** WPSEC-2026-1782
- **Plugin:** File Manager Pro – Filester (`filester`), https://wordpress.org/plugins/filester/
- **Affected versions:** all versions before 2.1.5
- **Fixed in:** 2.1.5 (Update to 2.1.5 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/filester
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1782/

## Description

The File Manager Pro – Filester plugin for WordPress is vulnerable to limited Path Traversal in all versions up to, and including, 2.1.4, due to the elFinder local file system volume checking that a joined path stays inside the configured root with a string-prefix comparison that ignores directory boundaries. This makes it possible for authenticated attackers, with Subscriber-level access and above, whose role has been granted file manager access with a restricted root folder, to create files and folders in, or move files into, sibling directories whose path begins with the same characters as that root. Files outside the root cannot be read this way.

## References

- https://wpsec.com/vuln/WPSEC-2026-1782/
- https://plugins.svn.wordpress.org/filester/tags/2.1.5/
- https://wordpress.org/plugins/filester/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1782/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.