PT-2026-5702 · Unknown · Com.Xiaoleilu.Loserver+1

Published 2026-02-02 · Updated 2026-03-03 · CVE-2025-66480

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wildfire IM versions prior to 1.4.3

Description Wildfire IM’s im-server component contains a critical issue in the file upload functionality within com.xiaoleilu.loServer.action.UploadFileAction. The application exposes an API endpoint ''/fs'' that handles multipart file uploads but does not properly sanitize the filename provided by the user. The writeFileUploadData method directly concatenates the configured storage directory with the filename from the upload request without removing directory traversal sequences. This allows an attacker to write arbitrary files to any location on the server's filesystem where the application process has write permissions, potentially leading to Remote Code Execution (RCE).

Recommendations Update Wildfire IM to version 1.4.3 or later.

Exploit

Fix

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2025-66480

GHSA-74HQ-JHX2-FQ6C

Affected Products

Wildfire Im

Com.Xiaoleilu.Loserver

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66480.json · Exploit
• https://github.com/wildfirechat/im-server/security/advisories/GHSA-74hq-jhx2-fq6c · Vendor Advisory
• https://github.com/wildfirechat/im-server/commit/2f9c4e028c01c64913cab32e7248bcca183a5230 · Patch
• https://osv.dev/vulnerability/CVE-2025-66480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66480 · Security Note
• https://github.com/wildfirechat/im-server/releases/tag/1.4.3 · Note
• https://t.me/cveNotify/153872 · Telegram Post
• https://twitter.com/CveFindCom/status/2018537790443590092 · Twitter Post
• https://twitter.com/CVEnew/status/2018465520966680942 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018462425985454483 · Twitter Post
• https://twitter.com/pulsepatchio/status/2019062433701400941 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018548283145073022 · Twitter Post