A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://gitee.com/wanglongcn/yifang/issues/IC0RCX | Exploit Issue Tracking |
| https://gitee.com/wanglongcn/yifang/issues/IC0RCX | Exploit Issue Tracking |
| https://vuldb.com/?ctiid.310674 | Permissions Required Third Party Advisory VDB Entry |
| https://vuldb.com/?id.310674 | Third Party Advisory VDB Entry |
Configurations
History
09 Jun 2025, 19:00
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:wanglongcn:yifang:*:*:*:*:*:*:*:* | |
| References | () https://gitee.com/wanglongcn/yifang/issues/IC0RCX - Exploit, Issue Tracking | |
| References | () https://vuldb.com/?id.310674 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.310674 - Permissions Required, Third Party Advisory, VDB Entry | |
| First Time |
Wanglongcn
Wanglongcn yifang |
02 Jun 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| CWE |
31 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-31 15:15
Updated : 2025-06-09 19:00
NVD link : CVE-2025-5381
Mitre link : CVE-2025-5381
JSON object : View
Products Affected
wanglongcn
- yifang
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')