Published:2020/12/10  Last Updated:2020/12/10

FileZen vulnerable to directory traversal


FileZen provided by Soliton Systems K.K. contains a directory traversal vulnerability.

Products Affected

  • FileZen versions from V3.0.0 to V4.2.2


FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface.
FileZen contains a directory traversal vulnerability (CWE-22).


A remote attacker may upload an arbitrary file in the specific directory in the product.
If a specialy crafted file is uploaded by an attacker, it may lead to an arbitrary OS command execution.


Update the software
Update the software to the latest version according to the information provided by the developer.
According to the developer, this vulnerability has been already addressed in V4.2.3 released on January 30, 2019.
In addition, the possible arbitrary OS command execution issue has been addressed in the following versions.

  • V4.2.6 (Released on December 7, 2020)
  • V5.0.1 (Released on December 9, 2020)

Vendor Status

Vendor Status Last Update Vendor Notes
Soliton Systems K.K. Vulnerable 2020/12/10 Soliton Systems K.K. website


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Base Score: 7.5
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
Base Score: 5.0
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)


Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Soliton Systems K.K. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert JPCERT-AT-2020-0044
Alert Regarding File Data Transfer Appliance FileZen
JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2020-5639
JVN iPedia JVNDB-2020-000082