Path Traversal Vulnerability in Doufox Web Application by Doufox
CVE-2025-2215

5.1MEDIUM

Key Information:

Vendor
Doufox
Status
Doufox
Vendor
CVE Published:
12 March 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability in Doufox up to version 0.2.0 allows remote attackers to exploit an unknown functionality through the file path manipulation in the argument 'dir'. This leads to a path traversal vulnerability that could potentially enable the unauthorized reading or modification of server files. Despite the vendor's early notification about the issue, there was no response, increasing the risk of potential exploits as the details are already public.

Affected Version(s)

Doufox 0.1

Doufox 0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-2215 - Proof of Concept

References

https://vuldb.com/?id.299287
vdb-entrytechnical-description
https://vuldb.com/?ctiid.299287
signaturepermissions-required
https://vuldb.com/?submit.512316
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.