CVE-2025-14520
Published: 11 December 2025
Description
A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/datafile/delfile. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit…
more
has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal by requiring validation of the filename argument to block directory traversal sequences like '../'.
Requires timely flaw remediation through patching or updating the vulnerable baowzh hfly CMS beyond the affected commit.
Limits exploitation impact by enforcing least privilege on low-privileged users, restricting access to arbitrary files for deletion.
Security SummaryAI
CVE-2025-14520 is a path traversal vulnerability (CWE-22) affecting the baowzh hfly PHP-based travel website CMS up to commit 638ff9abe9078bc977c132b37acbe1900b63491c. The issue resides in an unknown function within the file /admin/index.php/datafile/delfile, where manipulation of the filename argument enables attackers to traverse directories and perform arbitrary file deletion. The vulnerability carries a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) and was published on 2025-12-11.
The vulnerability can be exploited remotely by low-privileged users, such as authenticated administrators, with low attack complexity and no user interaction required. Successful exploitation allows deletion of arbitrary files on the server, resulting in low impacts to integrity and availability but no confidentiality loss.
Advisories from VulDB and a related GitHub entry detail the vulnerability but note no vendor response despite early contact; the product uses a rolling release strategy for updates. No patches or specific mitigations are mentioned, implying practitioners should monitor for newer commits beyond 638ff9abe9078bc977c132b37acbe1900b63491c.
An exploit is publicly available, increasing the risk of active exploitation in the wild.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables arbitrary file deletion, directly facilitating T1070.004 (Indicator Removal: File Deletion) for evasion and T1107 (File Deletion) for service disruption and impact.