CVE-2025-13435
Published: 20 November 2025
Description
A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be…
more
performed from remote. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents path traversal attacks by enforcing input validation mechanisms on the manipulable filename argument in the HttpClient Request function.
Mitigates the vulnerability by requiring identification, reporting, and correction of the specific flaw in the HttpClient module, including compensating fixes absent vendor patches.
Reduces impact of successful path traversal by enforcing least privilege on the affected application process, limiting access to unauthorized files and directories.
Security SummaryAI
CVE-2025-13435 is a path traversal vulnerability (CWE-22) affecting Dreampie Resty versions up to 1.3.1.SNAPSHOT. The issue resides in the Request function within the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the HttpClient Module, where manipulation of the filename argument enables path traversal.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with no user interaction required, though it demands high attack complexity. Successful exploitation results in low-level impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
VulDB advisories detail the issue and note that the exploit has been publicly disclosed, including proof-of-concept code on GitHub, with exploitability rated as difficult. The vendor was notified early but provided no response, indicating no official patch or mitigation guidance is available from them at this time. Practitioners should consult the referenced URLs for additional details on the PoC and implement compensating controls such as input validation or restricting access to affected endpoints.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in a public-facing HTTP client module directly enables exploitation of public-facing applications (T1190) for limited file access/modification.