PT-2025-49258 · Unknown · Warehouse Management System

Published 2025-12-05 · Updated 2025-12-12 · CVE-2025-65879

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Warehouse Management System version 1.2

Description The software contains an authenticated arbitrary file deletion issue. The /goods/deleteGoods API endpoint accepts a user-controlled goodsimg parameter. This parameter is directly concatenated with the server's UPLOAD PATH and passed to the File.delete() function without proper validation. An authenticated attacker can delete arbitrary files on the server by providing directory traversal payloads through the goodsimg parameter.

Recommendations Apply input validation to the goodsimg parameter of the /goods/deleteGoods endpoint to prevent directory traversal.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-65879

Affected Products

Warehouse Management System

References · 7

• 🔥 https://github.com/W000i/vuln/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65879 · Security Note
• https://twitter.com/CVEnew/status/1996980174571921632 · Twitter Post
• https://t.me/cveNotify/145590 · Telegram Post
• https://twitter.com/SecAideInfo/status/1997973926861844743 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997025372970377636 · Twitter Post