PT-2025-50614 · Unknown · Baowzh Hfly

Webray.Com.Cn · Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-14520

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions baowzh hfly versions prior to 638ff9abe9078bc977c132b37acbe1900b63491c

Description A path traversal weakness exists in baowzh hfly. The issue is related to the manipulation of the filename argument within an unknown function of the file '/admin/index.php/datafile/delfile'. This allows for remote exploitation. The exploit has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 638ff9abe9078bc977c132b37acbe1900b63491c should be updated.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14520

Affected Products

Baowzh Hfly

References · 7

• 🔥 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20delfile%20filename%20Arbitrary%20file%20delete.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14520 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14520 · Vendor Advisory
• https://vuldb.com/?id.335858 · Note
• https://vuldb.com/?submit.702948 · Note
• https://vuldb.com/?ctiid.335858 · Note
• https://twitter.com/CVEnew/status/1999144281525637528 · Twitter Post