Cyber Posture

CVE-2025-13435

MediumPublic PoC

Published: 20 November 2025

Published
20 November 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0032 54.6th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be…

more

performed from remote. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents path traversal attacks by enforcing input validation mechanisms on the manipulable filename argument in the HttpClient Request function.

prevent

Mitigates the vulnerability by requiring identification, reporting, and correction of the specific flaw in the HttpClient module, including compensating fixes absent vendor patches.

prevent

Reduces impact of successful path traversal by enforcing least privilege on the affected application process, limiting access to unauthorized files and directories.

Security SummaryAI

CVE-2025-13435 is a path traversal vulnerability (CWE-22) affecting Dreampie Resty versions up to 1.3.1.SNAPSHOT. The issue resides in the Request function within the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the HttpClient Module, where manipulation of the filename argument enables path traversal.

The vulnerability can be exploited remotely by unauthenticated attackers over the network with no user interaction required, though it demands high attack complexity. Successful exploitation results in low-level impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

VulDB advisories detail the issue and note that the exploit has been publicly disclosed, including proof-of-concept code on GitHub, with exploitability rated as difficult. The vendor was notified early but provided no response, indicating no official patch or mitigation guidance is available from them at this time. Practitioners should consult the referenced URLs for additional details on the PoC and implement compensating controls such as input validation or restricting access to affected endpoints.

Details

CWE(s)

Affected Products

dreampie
resty
≤ 1.3.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Path traversal vulnerability in a public-facing HTTP client module directly enables exploitation of public-facing applications (T1190) for limited file access/modification.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References