VULNERABILITY INTELLIGENCE

CVE-2025-5381

CVSS score2.7 LOW

EPSS probability0.71%

CISA KEVNot currently listed

Published2025-05-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Weakness classification

cna@vuldb.com: CWE-22
nvd@nist.gov: CWE-22

Primary references

cna@vuldb.com — Exploit, Issue Tracking
cna@vuldb.com — Permissions Required, Third Party Advisory, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Issue Tracking