CVE-2025-65878

Executive Summary

CVE-2025-65878 is an unauthenticated path traversal (CWE-22) vulnerability in Yeqifu Warehouse Management System version 1.2. The endpoint /file/showImageByPath accepts user-controlled path parameters without sanitization, allowing an attacker to read arbitrary files from the server's file system. The vulnerability carries a CVSS v3.1 base score of 7.5 (HIGH), driven by network reachability, low attack complexity, no authentication requirement, and high confidentiality impact; no official patch or vendor mitigation is currently available.

Technical Analysis

The vulnerable component is a file-serving endpoint exposed by Yeqifu Warehouse Management System version 1.2. According to the NVD description, the endpoint /file/showImageByPath is designed to return image content to the caller by resolving a path supplied through a user-controllable parameter. The application fails to sanitize or canonicalize that path value before using it to locate a file on the server's file system.

The flaw class is classic directory traversal (CWE-22, "Improper Limitation of a Pathname to a Restricted Directory"). The core mechanism is that the application accepts a path string and passes it to a file-access operation without validating that the resolved path remains inside the intended image/document directory. By supplying traversal sequences (for example, the standard ../ parent-directory notation), an attacker can cause the resolved path to escape the intended base directory and point to an arbitrary file elsewhere on the file system.

Key characteristics of this issue, as derivable from the provided data:

• Attack vector: Network (AV:N). The endpoint is reachable over the network as part of the application's web interface.
• Authentication: None required (PR:N). No privileges or valid session appear necessary to reach the vulnerable path resolution.
• User interaction: None (UI:N).
• Complexity: Low (AC:L). The manipulation is a direct parameter value — no race condition or special precondition is described.
• Confidentiality impact: High (C:H), because the endpoint returns the contents of the referenced file to the requester.
• Integrity and availability impact: None (I:N/A:N) per the CVSS vector — the vulnerability is a read primitive, not a write or denial-of-service primitive.

Because no code-level details (specific parameter name, parsing library, base directory, or application framework) are disclosed in the NVD description, the exact implementation of the path resolution cannot be described without speculation. What is verifiable is the vulnerable endpoint path (/file/showImageByPath) and the absence of sanitization on its path parameter. The precise parameter identifier is not provided in the source data and is therefore not asserted here.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, consistent with the NVD description. No public exploit code or Nuclei template was identified in the data sources; the POC status is "Public" at the disclosure level, meaning the vulnerability (and its class of abuse) is publicly documented.

1. Reconnaissance / target identification An attacker identifies internet-exposed instances of the Yeqifu Warehouse Management System by fingerprinting the application's web interface and file-serving behavior. The endpoint /file/showImageByPath is the primary indicator of interest; requests to it that return image content confirm the file-serving functionality is present and reachable. Exposed management systems of this type are frequently discoverable through web-content fingerprinting of the application's login and asset pages.

2. Triggering the flaw class The attacker issues an HTTP request to /file/showImageByPath, supplying a crafted path value intended to traverse outside the intended content directory. At the vulnerability-class level, this is accomplished by embedding relative-path traversal sequences so the resolved location points to a file outside the expected base directory. The application does not sanitize the supplied path, so the traversal is honored. No specialized tooling is required; a standard HTTP client is sufficient.

3. Payload / execution method Execution is data-plane rather than code-execution: the crafted request causes the server to resolve and return the contents of the targeted file. The attacker iterates over path values to enumerate and exfiltrate files of interest. Because the flow is unauthenticated, no credential or session is needed. The absence of sanitization is the sole enabling condition. (Because the NVD entry does not disclose the exact parameter name or the application's configured base directory, those specifics are not asserted; the exploit is characterized only by the disclosed endpoint and traversal class.)

4. Post-exploitation impact Successful traversal yields a client-side file-read primitive. The attacker can leverage this to harvest sensitive system information — for example, configuration and credential material stored on the server — which may enable lateral movement or privilege escalation against connected systems. The stated impact is information leakage (confidentiality), with no integrity or availability effect described. The data read is bounded by the permissions of the process running the application.

Impact Assessment

Business impact: The endpoint provides an unauthenticated read primitive against the server hosting the Warehouse Management System. Because the vulnerability exposes arbitrary file contents (subject to process permissions), the primary business risk is disclosure of sensitive information — configuration data, credentials, system files, and potentially business data accessible to the application process. Warehouse management systems frequently hold inventory, supplier, and logistics data, and may be integrated with internal networks, raising the potential blast radius beyond the single host.

CVSS v3.1 subscores (base 7.5, HIGH):

• AV:N — reachable over the network.
• AC:L — no special conditions required to exploit.
• PR:N — no authentication needed; anonymous attackers can abuse the endpoint.
• UI:N — no victim interaction required.
• S:U — impact is scoped to the vulnerable component.
• C:H — high confidentiality impact; arbitrary file contents can be disclosed.
• I:N — no integrity impact; this is a read-only primitive.
• A:N — no availability impact.

Affected systems: Deployments of Yeqifu Warehouse Management System version 1.2 with the /file/showImageByPath endpoint exposed. Environments where the application process runs with elevated privileges, or where it can reach sensitive files on the same host or mounted volumes, face greater exposure. No affected-version range beyond the explicitly stated "version 1.2" is documented, and no OSV package mapping is available.

Exploit maturity: A public disclosure exists, but no public exploit code or Nuclei template was identified in the provided sources. EPSS is 0.00696 (51.0 percentile), indicating a low modeled probability of exploitation in the near term, though this can change as proof-of-concept tooling or scanning activity emerges. CISA KEV status: not listed.

Detection Guidance

Detection should focus on anomalous request patterns against the /file/showImageByPath endpoint, especially requests containing traversal sequences or unexpected file-extension targets, and on suspicious outbound content type/behavior from the application server.

Sigma Rule

title: Yeqifu WMS Path Traversal in showImageByPath Endpoint (CVE-2025-65878)
id: 8f1c2a54-2b6e-4f3a-9c1d-7c65878a0001
status: experimental
description: Detects HTTP requests to the Yeqifu Warehouse Management System endpoint /file/showImageByPath containing directory traversal sequences indicative of CVE-2025-65878.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-65878
author: Valters IT Threat Intelligence
date: 2025-01-01
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025.65878
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/file/showImageByPath'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '....//'
      - '..%252f'
  condition: selection_endpoint and selection_traversal
falsepositives:
  - Legitimate image path values that legitimately contain encoded dots
level: high

YARA Rule

rule CVE_2025_65878_Yeqifu_WMS_Traversal
{
    meta:
        description = "Detects HTTP request artifacts targeting the Yeqifu WMS /file/showImageByPath traversal (CVE-2025-65878) in logs or capture files"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-65878"
        date = "2025-01-01"
        severity = "high"

    strings:
        $ep = "/file/showImageByPath" ascii nocase
        $tr1 = "../" ascii
        $tr2 = "..%2f" ascii nocase
        $tr3 = "..%5c" ascii nocase
        $tr4 = "%2e%2e%2f" ascii nocase
        $tr5 = "..%252f" ascii nocase

    condition:
        $ep and any of ($tr*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-65878 Yeqifu WMS showImageByPath Directory Traversal Attempt"; flow:established,to_server; http.uri; content:"/file/showImageByPath"; http.uri; pcre:"/(\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.%252f)/i"; classtype:attempted-recon; reference:cve,2025-65878; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-65878; sid:202565878; rev:1; metadata:created_at 2025_01_01, updated_at 2025_01_01;)

Elastic Detection

// EQL: detect HTTP requests to the vulnerable endpoint carrying traversal sequences
network where
  http.request.method != null and
  process.name != null and
  stringContains(url.path, "/file/showImageByPath") and
  (
    stringContains(url.query, "../") or
    stringContains(url.query, "..%2f") or
    stringContains(url.query, "..%5c") or
    stringContains(url.query, "%2e%2e%2f") or
    stringContains(url.query, "..%252f")
  )

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval query=coalesce(uri_query, cs_uri_query, "")
| where like(uri, "%/file/showImageByPath%")
| search query="*../*" OR query="*..%2f*" OR query="*..%5c*" OR query="*%2e%2e%2f*" OR query="*..%252f*"
| stats count min(_time) as first_seen max(_time) as last_seen values(query) as traversal_payloads by src_ip, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsecurity,cve-2025-65878,">
  <rule id="100878" level="12">
    <if_sid>31100</if_sid>
    <id>^/file/showImageByPath</id>
    <match>\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.%252f</match>
    <description>CVE-2025-65878: Path traversal attempt against Yeqifu WMS /file/showImageByPath endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2025_65878,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented for CVE-2025-65878.

1. Immediate mitigations

• Restrict network access to the Warehouse Management System so the /file/showImageByPath endpoint is not reachable from untrusted networks. Place the application behind authentication (reverse proxy, VPN, or zero-trust gateway) if it must be internet-adjacent.
• Apply a reverse-proxy or WAF rule that rejects requests to /file/showImageByPath containing traversal sequences (../, encoded variants such as ..%2f, ..%5c, %2e%2e%2f, ..%252f), and normalize/canonicalize paths before inspection.
• If the image-serving functionality is not required in the deployment, disable or block the endpoint entirely at the web-server or proxy layer.
• Run the application process with the least privilege necessary and in an isolated container or segmented host to limit which files a successful traversal can read.

2. Patch / upgrade steps

• No patched version is currently identified. Monitor the vendor (Yeqifu) for an official advisory or fixed release. When a patch becomes available, validate it, test in a staging environment, and deploy promptly.
• Because no fix exists, do not rely on version upgrades as a mitigation at this time.

3. Long-term hardening

• Enforce canonicalization and a strict allowlist on any file-path parameter: resolve the requested path and verify it resides within the intended base directory before serving. Reject absolute paths and any traversal sequences.
• Adopt secure-development controls for file-serving endpoints (path normalization, base-directory confinement, extension allowlisting).
• Deploy continuous file-integrity and access monitoring on hosts running the application to detect reads of sensitive files.
• Maintain asset inventory and reduce the internet-exposed footprint of management systems; segment warehouse/OT-adjacent systems from general corporate networks.

References

• NVD — CVE-2025-65878: https://nvd.nist.gov/vuln/detail/CVE-2025-65878
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2025-65878 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2025-65878
• CISA Known Exploited Vulnerabilities Catalog (verify KEV status for CVE-2025-65878): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit-in-the-wild evidence: Based on the data provided, CVE-2025-65878 is not listed in CISA KEV, no exploit code was identified, and no named threat-actor campaign is associated with this CVE. The vulnerability is publicly disclosed, and the abuse pattern (CWE-22 traversal against a file-serving endpoint) is a well-known class, but no confirmed in-the-wild exploitation is documented at this time.