CVE-2025-5381CWE-22

Yifang CMS Admin Panel downloadFile path traversal

Medium · published May 31, 2025

CVSS v4.0
5.1
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00677 · 51.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-05-31T14:31Z
EPSS history
Timeline
  • 31 MAY 14:31Z
    Yifang CMS Admin Panel downloadFile path traversal
    cvelistv5