Cyber Posture

CVE-2025-15449

MediumPublic PoC

Published: 05 January 2026

Published
05 January 2026
Modified
08 March 2026
KEV Added
—
Patch
—
CVSS Score 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0021 43.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is…

more

used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the objectName input in MinioController.delete to block path traversal sequences like '../', preventing exploitation.

AC-3 Access Enforcement good match
prevent

Enforces logical access controls to restrict delete operations to authorized directories only, mitigating path traversal beyond intended storage paths.

SI-2 Flaw Remediation good match
prevent

Requires timely identification and correction of the path traversal flaw in src/main/java/com/macro/mall/controller/MinioController.java delete function.

Security SummaryAI

CVE-2025-15449 is a path traversal vulnerability (CWE-22) affecting cld378632668 JavaMall up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The issue resides in the delete function of the file src/main/java/com/macro/mall/controller/MinioController.java, where manipulation of the objectName argument enables traversal outside intended directories.

A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation results in low impacts to integrity and availability, with no confidentiality impact, as scored at CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

The product uses continuous delivery with rolling releases, so no specific details on affected or updated versions are available. The vendor was contacted early regarding this disclosure but did not respond. Additional details appear in advisories at the provided references, including VulDB entries and a GitHub disclosure document.

Details

CWE(s)
CWE-22

Affected Products

cld378632668
javamall
1.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal in web controller's delete function enables exploitation of public-facing application for arbitrary file deletion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References