What’s Vulnerable › Vulnerabilities

CVE-2020-36246

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-19 · updated 2026-06-17
• Weakness: CWE-78

Description

Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.

Affected products

• Amaze File Manager Project Amaze File Manager: before 3.5.1 — fixed in 3.5.1

How to fix

Upgrade to a fixed version: Amaze File Manager Project Amaze File Manager 3.5.1. Check the vendor advisory for mitigations.

References

• https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt
• https://github.com/TeamAmaze/AmazeFileManager/releases/tag/v3.5.1
• https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt
• https://github.com/TeamAmaze/AmazeFileManager/releases/tag/v3.5.1

Get alerted when CVE-2020-36246 or the next vulnerability affects your stack