PT-2025-28122 · Unknown · Risesoft-Y9 Digital-Infrastructure

Shenxiusecurity · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-7108

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: risesoft-y9 Digital-Infrastructure versions prior to 9.6.8

Description: A critical issue affects the deleteFile function in the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java. The manipulation of the fullPath argument leads to path traversal. This issue can be exploited remotely. An exploit has been publicly disclosed and may be utilized. The vendor was contacted prior to this disclosure but did not respond.

Recommendations: For risesoft-y9 Digital-Infrastructure versions prior to 9.6.8, as a temporary workaround, consider disabling the deleteFile function in the Y9FileController.java file until a patch is available. Restrict access to the vulnerable filemanager module to minimize the risk of exploitation. Avoid using the fullPath argument in the affected function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-7108

Affected Products

Risesoft-Y9 Digital-Infrastructure

References · 5

• 🔥 https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250621-01.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7108 · Security Note
• https://vuldb.com/?id.315019 · Note
• https://vuldb.com/?ctiid.315019 · Note
• https://vuldb.com/?submit.601825 · Note