CVE-2024-25153: Fortra Filecatalyst Workflow

Critical severity, CVSS 9.8. EPSS: 41.7% chance of exploitation in the next 30 days.

A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.

Affected products

• Fortra Filecatalyst Workflow: from 5.0, before 5.1.6 (fixed in 5.1.6); version 5.1.6 only

Published 2024-03-13. Last modified 2026-06-17.