CVE-2025-9461
diyhi bbs File Compression FilePackageManageAction.java information disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 26, 2025
- Updated
- Aug 26, 2025
- Reserved
- Aug 25, 2025
Description
A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePackageManageAction.java of the component File Compression Handler. This manipulation of the argument idGroup causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
bbsdiyhi |
|
References
- VDB-321296 | diyhi bbs File Compression FilePackageManageAction.java information disclosurevdb-entrytechnical-description
- VDB-321296 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #634295 | diyhi bbs 6.8 Sensitive information leakage vulnerabilitythird-party-advisory
- https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e1.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.