PT-2026-1202 · Javamall · Javamall

Zyhsec · Published 2026-01-05 · Updated 2026-03-08 · CVE-2025-15449

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions JavaMall versions prior to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0

Description A path traversal issue exists due to manipulation of the objectName argument within the delete function located in the file src/main/java/com/macro/mall/controller/MinioController.java. This allows for remote exploitation. The product utilizes continuous delivery with rolling releases, making specific version details for affected and updated releases unavailable. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 should be updated. As a temporary workaround, restrict access to the delete function in the MinioController.java file until a patch is available. Avoid using untrusted or user-supplied input for the objectName parameter in the affected API endpoint.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-15449

Affected Products

Javamall

References · 10

• 🔥 https://github.com/zyhzheng500-maker/cve/blob/main/JavaMall%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15449 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15449 · Vendor Advisory
• https://t.me/cveNotify/147661 · Telegram Post
• https://vuldb.com/?ctiid.339482 · Note
• https://t.me/cveNotify/154644 · Telegram Post
• https://twitter.com/CVEnew/status/2008017768826691737 · Twitter Post
• https://vuldb.com/?id.339482 · Note
• https://t.me/CVEtracker/41337 · Telegram Post
• https://vuldb.com/?submit.722000 · Note