8 CVEs matched to FileCloud by name in NVD, none on CISA's Known Exploited list.
Back to the FileCloud profile · Alternatives to FileCloud · CVE RSS feed
1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a cra…
CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2022 | 0 | 3 | 2 | 0 | 0 | 5 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2018 | 0 | 1 | 0 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2022-25241 | 3.3% | 88% |
| CVE-2022-39833 | 2.8% | 86% |
| CVE-2020-26524 | 1.4% | 73% |
| CVE-2016-6578 | 0.9% | 58% |
| CVE-2022-24633 | 0.8% | 56% |
| CVE-2022-1958 | 0.7% | 54% |
| CVE-2022-25242 | 0.4% | 31% |
| CVE-2025-26127 | 0.2% | 14% |
A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.
CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with t…
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A mal…
A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to…
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existenc…
In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).
In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.
CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, pr…