CVE-2025-65879: Path Traversal
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOADPATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65879?
CVE-2025-65879 is classified as a critical severity vulnerability due to the potential for remote attackers to delete arbitrary files.
How do I fix CVE-2025-65879?
To fix CVE-2025-65879, validate and sanitize the user-controlled goodsimg parameter before it is used to form file paths.
What systems are affected by CVE-2025-65879?
CVE-2025-65879 affects version 1.2 of the Warehouse Management System.
What kind of attack can CVE-2025-65879 facilitate?
CVE-2025-65879 can facilitate authenticated arbitrary file deletion attacks.
Is authentication required to exploit CVE-2025-65879?
Yes, an attacker must be authenticated to exploit CVE-2025-65879.