CVE-2025-65878

HighCVSS 7.5

Published: 05/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.70%

51th percentile - higher than 51% of all known CVEs

Summary

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint /file/showImageByPath does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.

Risk Assessment

Risk of leaking confidential data such as configuration files, passwords, or customer data. The attack may be performed without authentication if the endpoint is public.

Recommendation

Update the system to a patched version or manually add path validation in the /file/showImageByPath endpoint, e.g., by blocking characters like ../.

Other vulnerabilities in Warehouse Management System

CVE-2025-65879High
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.

Original NVD description (English source)

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS