CVE-2025-11336
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do leads to path traversal. The attack may be performed remotely and the exploit has been disclosed publicly.
Risk Assessment
The vulnerability enables remote reading of arbitrary files on the server, potentially leaking sensitive data. The vendor's lack of response increases the risk of exploitation.
Recommendation
Restrict access to the platform from untrusted networks, implement server-side validation of the fileName argument, and deploy WAF rules to block path traversal. Urgently contact the vendor for a fix.
Other vulnerabilities in Four-Faith Water Conservancy Informatization Platform
See all- CVE-2025-11337Medium
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do results in path traversal. The attack can be initiated remotely and the exploit is now public.
- CVE-2025-11018Medium
A vulnerability in Four-Faith Water Conservancy Informatization Platform 1.0 affects an unknown function in /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Manipulation of the fileName argument leads to path traversal. The attack can be launched remotely and the exploit is public.
- CVE-2025-10709Medium
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS