PT-2026-1202 · Javamall · Javamall

Zyhsec · Publicado 2026-01-05 · Atualizado 2026-03-08 · CVE-2025-15449

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions JavaMall versions prior to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0

Description A path traversal issue exists due to manipulation of the objectName argument within the delete function located in the file src/main/java/com/macro/mall/controller/MinioController.java. This allows for remote exploitation. The product utilizes continuous delivery with rolling releases, making specific version details for affected and updated releases unavailable. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 should be updated. As a temporary workaround, restrict access to the delete function in the MinioController.java file until a patch is available. Avoid using untrusted or user-supplied input for the objectName parameter in the affected API endpoint.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-15449

Produtos afetados

Javamall

Referências · 10

• 🔥 https://github.com/zyhzheng500-maker/cve/blob/main/JavaMall%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md · Exploit
• https://t.me/cveNotify/147661 · Publicação no Telegram
• https://vuldb.com/?ctiid.339482 · Nota
• https://t.me/cveNotify/154644 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-15449 · Nota de Segurança
• https://twitter.com/CVEnew/status/2008017768826691737 · Publicação no Twitter
• https://vuldb.com/?id.339482 · Nota
• https://t.me/CVEtracker/41337 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-15449 · Aviso do Fabricante
• https://vuldb.com/?submit.722000 · Nota