CVE-2025-9650: yeqifu carRental AppFileUtils.java removeFileByPath path traversal
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9650?
The severity of CVE-2025-9650 is considered high due to the risk of path traversal which can lead to unauthorized file access.
How do I fix CVE-2025-9650?
To fix CVE-2025-9650, it is recommended to sanitize user inputs for the carimg parameter in the removeFileByPath function.
What software is affected by CVE-2025-9650?
CVE-2025-9650 affects yeqifu carRental versions up to and including 3fabb7eae93d209426638863980301d6f99866b3.
What type of vulnerability is CVE-2025-9650?
CVE-2025-9650 is a path traversal vulnerability that affects file handling in the application.
Can CVE-2025-9650 lead to data exposure?
Yes, CVE-2025-9650 can lead to data exposure by allowing attackers to access sensitive files outside of the intended directory.