Path Traversal Vulnerability in File Upload API of Xiaowei1118 Java Server
CVE-2025-4178

5.3MEDIUM

Key Information:

Vendor: Xiaowei1118
Status: Java Server
Vendor: CVE Published:; 1 May 2025

🔔 Create Xiaowei1118 Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-4178?

A path traversal vulnerability was identified in the File Upload API of Xiaowei1118 Java Server, specifically within the FoodController.java file. This security flaw allows attackers to manipulate file paths, potentially exposing sensitive files and directories on the server. The vulnerability can be exploited remotely, leading to unauthorized access to critical data. As the product utilizes a continuous delivery model, detailed versioning of affected releases is not explicitly available, making it essential for users to remain vigilant regarding updates and patching.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

java_server 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-4178 - Proof of Concept