Critical severity9.8NVD Advisory· Published Mar 13, 2024· Updated Jun 17, 2026

CVE-2024-25153

Description

A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fortra/Filecatalyst Workflow2 versions
cpe:2.3:a:fortra:filecatalyst_workflow:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:fortra:filecatalyst_workflow:*:*:*:*:*:*:*:*range: >=5.0,<5.1.6
- cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build112:*:*:*:*:*:*
FileCatalyst/Workflowllm-fuzzy
Fortra/FileCatalystcpe-rescue
Range: 5.1.4

Patches

Vulnerability mechanics

References

www.fortra.com/security/advisory/fi-2024-002nvdVendor Advisory
filecatalyst.software/public/filecatalyst/Workflow/5.1.6.114/fcweb_releasenotes.htmlnvdRelease Notes
github.com/nettitude/CVE-2024-25153/blob/master/CVE-2024-25153.pynvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.033
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000