CVE-2025-65879 Details
Description
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.
An authenticated arbitrary file deletion vulnerability exists in Warehouse Management System version 1.2. The vulnerability arises in the /goods/deleteGoods endpoint, where the user-controlled goodsimg parameter is concatenated with the server's UPLOAD_PATH and passed to the File.delete() method without proper validation. This flaw allows remote authenticated attackers to delete arbitrary files on the server by exploiting directory traversal payloads.
It is recommended to implement path normalization to block traversal, reject absolute paths, and enforce file deletion only within a designated whitelist directory. Additionally, validate that the file is genuinely associated with the corresponding goods entry and consider using server-side file ID mapping instead of direct path references.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/W000i/vuln/issues/3 | [email protected] | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| yeqifu warehouse management system | <= 1.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Dec 5, 2025 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | New CVE Received | [email protected] |