CVE-2025-6534: xxyopen/201206030 novel-plus File FileController.java remove resource injection
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xxyopen/201206030 novel-plusto a version that resolves this vulnerability.Fixed in 5.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6534?
CVE-2025-6534 is classified as a problematic vulnerability that affects xxyopen's novel-plus software.
How do I fix CVE-2025-6534?
To fix CVE-2025-6534, you should update the xxyopen novel-plus software to version 5.1.4 or later.
What components are affected by CVE-2025-6534?
CVE-2025-6534 affects the FileHandler component in the FileController.java of the xxyopen novel-plus application.
What could be the impact of exploiting CVE-2025-6534?
Exploiting CVE-2025-6534 may lead to unauthorized file manipulation within the novel-plus application.
Which versions of xxyopen novel-plus are vulnerable to CVE-2025-6534?
Versions of xxyopen novel-plus up to and including 5.1.3 are vulnerable to CVE-2025-6534.