PT-2025-26657 · Unknown · Novel-Plus

Bpy9Ft · Published 2025-06-24 · Updated 2025-07-09 · CVE-2025-6534

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: xxyopen/201206030 novel-plus versions through 5.1.3

Description: A problematic issue exists due to improper control of resource identifiers. This issue affects the remove function within the novel-admin/src/main/java/com/java2nb/common/controller/FileController.java file of the File Handler component. The attack can be initiated remotely and is considered to have high complexity and difficult exploitability. The exploit for this issue has been publicly disclosed. The vendor was informed of the disclosure but did not respond.

Recommendations: Versions prior to 5.1.4 should be used. As a temporary workaround, consider disabling the remove function until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2025-6534

Affected Products

Novel-Plus

References · 9

• 🔥 https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion#poc · Exploit
• 🔥 https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6534 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6534 · Vendor Advisory
• https://t.me/cvenotify/128265 · Telegram Post
• https://vuldb.com/?id.313653 · Note
• https://twitter.com/CVEnew/status/1937344579642052941 · Twitter Post
• https://vuldb.com/?ctiid.313653 · Note
• https://vuldb.com/?submit.596505 · Note