Path Traversal Vulnerability in Dreampie Resty HttpClient Module
CVE-2025-13435

6.3MEDIUM

Key Information:

Vendor

Dreampie

Status
Resty
Vendor
CVE Published:
20 November 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-13435?

A security vulnerability identified in Dreampie Resty HttpClient Module allows for path traversal via manipulation of the filename parameter in the Request function of the HttpClient.java file. This issue impacts versions up to 1.3.1.SNAPSHOT and can potentially allow an attacker to access restricted directories and files. Although the complexity of the exploit is reported as high, with attacks being difficult to execute, they remain a significant risk, particularly since the exploit has already been publicly disclosed. The vendor has not responded to inquiries regarding this security concern.

Affected Version(s)

Resty 1.3.1.SNAPSHOT

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-13435 - Proof of Concept

References

https://vuldb.com/?id.332979
vdb-entrytechnical-description
https://vuldb.com/?ctiid.332979
signaturepermissions-required
https://vuldb.com/?submit.687603
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

sh7err (VulDB User)
JSON
.
CVE-2025-13435 : Path Traversal Vulnerability in Dreampie Resty HttpClient Module