CVE-2025-6453
diyhi bbs API ForumManageAction.java add path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 22, 2025
- Updated
- Jun 23, 2025
- Reserved
- Jun 20, 2025
Description
A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
bbsdiyhi |
|
References
- VDB-313560 | diyhi bbs API ForumManageAction.java add path traversalvdb-entrytechnical-description
- VDB-313560 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #598862 | diyhi bbs 6.8 Path Traversalthird-party-advisory
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.mdexploit
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md#steps-to-reproduceexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.