CVE-2025-14520
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c affects an unknown function in the file /admin/index.php/datafile/delfile. Manipulating the filename argument causes path traversal. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk involves remote access to arbitrary files on the server, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
It is recommended to immediately restrict access to the admin panel and apply vendor patches. Also monitor logs for unusual requests.
Other vulnerabilities in baowzh hfly
See all- CVE-2025-14522Medium
A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php. Manipulation of the argument imgFile results in unrestricted upload. The attack can be initiated remotely, and the exploit is now public and may be used.
- CVE-2025-14521Medium
A vulnerability in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c affects an unknown function in the file /admin/index.php/datafile/download. Manipulating the filename argument leads to path traversal. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/datafile/delfile. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS