CVE-2025-4178 Details
Description
A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.java of the component File Upload API. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
A critical path traversal vulnerability has been identified in the Xiaowei1118 Java_Server application, specifically in the File Upload API within the FoodController.java file. This vulnerability, present in versions up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows, allows for arbitrary file deletion by manipulating file paths. The issue arises from inadequate validation of external parameters in the file deletion process, enabling exploitation through remote attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-02.md | CISA-ADP | Exploit |
| https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-02.md | [email protected] | Exploit |
| https://vuldb.com/?ctiid.306797 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.306797 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.561794 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xiaowei1118 java server | <= 2019-09-22 |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2025 | Initial Analysis | [email protected] |
| May 2, 2025 | CVE Modified | CISA-ADP |
| May 1, 2025 | New CVE Received | [email protected] |