CVE-2025-65878

7.5 highEPSS 0.7%

High (7.5) in yeqifu warehouse management system. EPSS 0.7% chance of exploitation in the next 30 days.

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-12-05
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

yeqifu:warehouse_management_system

References

https://github.com/W000i/vuln/issues/2

Check your stack JSON