PT-2025-23406 · Unknown · Yifang Cms

Ic0Rcxyifang · Published 2025-05-31 · Updated 2025-05-31 · CVE-2025-5381

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yifang CMS versions up to 2.0.2

Description A problematic issue was found in the Admin Panel component, specifically in the downloadFile function of the /api/File/downloadFile API endpoint. The manipulation of the File argument leads to path traversal. This issue can be exploited remotely.

Recommendations For Yifang CMS versions up to 2.0.2, consider disabling the downloadFile function of the /api/File/downloadFile API endpoint until a patch is available. Restrict access to the Admin Panel to minimize the risk of exploitation. Avoid using the File argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-5381

Affected Products

Yifang Cms

References · 8

• 🔥 https://gitee.com/wanglongcn/yifang/issues/IC0RCX · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5381 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5381 · Vendor Advisory
• https://twitter.com/CVEnew/status/1928826438376984626 · Twitter Post
• https://t.me/cvetracker/25087 · Telegram Post
• https://vuldb.com/?id.310674 · Note
• https://t.me/cvenotify/124247 · Telegram Post
• https://vuldb.com/?ctiid.310674 · Note