FileZen vulnerable to directory traversal


FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface.
FileZen contains a directory traversal vulnerability (CWE-22).

Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Soliton Systems K.K. coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.5 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products

Soliton Systems K.K.
  • FileZen versions from V3.0.0 to V4.2.2


A remote attacker may upload an arbitrary file in the specific directory in the product.
If a specialy crafted file is uploaded by an attacker, it may lead to an arbitrary OS command execution.

[Update the software]
Update the software to the latest version according to the information provided by the developer.
According to the developer, this vulnerability has been already addressed in V4.2.3 released on January 30, 2019.
In addition, the possible arbitrary OS command execution issue has been addressed in the following versions.

* V4.2.6 (Released on December 7, 2020)
* V5.0.1 (Released on December 9, 2020)
Vendor Information

Soliton Systems K.K.
CWE (What is CWE?)

  1. Path Traversal(CWE-22) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2020-5639

  1. JVN : JVN#12884935
  2. JPCERT : Alert Regarding File Data Transfer Appliance FileZen
Revision History

  • [2020/12/10]
      Web page was published