CVE-2025-7108: risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal
A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile of the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java. The manipulation of the argument fullPath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7108?
CVE-2025-7108 is classified as a critical vulnerability.
How do I fix CVE-2025-7108?
To fix CVE-2025-7108, you should update the risesoft-y9 Digital-Infrastructure software to version 9.6.8 or later.
What is the impact of CVE-2025-7108?
The impact of CVE-2025-7108 includes potential unauthorized file deletion due to a vulnerability in the deleteFile function.
Which versions are affected by CVE-2025-7108?
CVE-2025-7108 affects all versions of risesoft-y9 Digital-Infrastructure up to and including version 9.6.7.
Who is the vendor for CVE-2025-7108?
The vendor for CVE-2025-7108 is risesoft-y9.