title: File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal
description: The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Unknown
product: File Manager
versions:
status: affected, versionType: semver, version: 0, lessThan: 6.3
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}