Path Traversal Vulnerability in File Upload API of Xiaowei1118 Java Server
CVE-2025-4178

5.3MEDIUM

Key Information:

Vendor
Xiaowei1118
Status
Java Server
Vendor
CVE Published:
1 May 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A path traversal vulnerability was identified in the File Upload API of Xiaowei1118 Java Server, specifically within the FoodController.java file. This security flaw allows attackers to manipulate file paths, potentially exposing sensitive files and directories on the server. The vulnerability can be exploited remotely, leading to unauthorized access to critical data. As the product utilizes a continuous delivery model, detailed versioning of affected releases is not explicitly available, making it essential for users to remain vigilant regarding updates and patching.

Affected Version(s)

java_server 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-4178 - Proof of Concept

References

https://vuldb.com/?id.306797
vdb-entry
https://vuldb.com/?ctiid.306797
signaturepermissions-required
https://vuldb.com/?submit.561794
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.