CVE-2025-14965 Details
Description
A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/main/java/per/ccm/ygmall/extra/controller/ResourceController.java. Performing manipulation results in path traversal. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
A path traversal vulnerability has been identified in the Yougou Mall application, specifically in versions up to commit 0a771fa817c924efe52c8fe0a9a6658eee675f9f. The issue arises in the 'Upload' function of the 'ResourceController.java' file, where the application fails to properly validate file extensions during the upload process. This oversight allows attackers to upload arbitrary files, potentially leading to unauthorized code execution. The vulnerability is exacerbated by the application's rolling release model, which provides continuous delivery but lacks clear versioning for affected or patched releases.
It is recommended to implement proper file extension validation, allowing only whitelisted file types to be uploaded. Additionally, checks should be introduced to prevent directory traversal by disallowing sequences that reference parent directories.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 19, 2025CISA-ADP
Assessed Dec 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zyhzheng500-maker/cve/blob/main/yougou-mall%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md | [email protected] | ExploitTechnical Description |
| https://github.com/zyhzheng500-maker/cve/blob/main/yougou-mall%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md | [email protected] | |
| https://vuldb.com/?ctiid.337600 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.337600 | [email protected] | AdvisoryPartial Content |
| https://vuldb.com/?submit.717732 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/?submit.721081 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1541492390c yougou-mall | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 27, 2025 | CVE Modified | [email protected] |
| Dec 19, 2025 | New CVE Received | [email protected] |