CVE-2025-6109
BaseFortify
Publication date: 2025-06-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-6109 is a path traversal vulnerability in the javahongxi whatsmars software version 2021.4.0. It exists in the initialize function of the InitializrController.java file, where improper handling of the artifactId argument allows an attacker to manipulate the file path. This flaw enables an attacker to traverse directories outside the intended restricted directory and access arbitrary files, particularly those ending with the .tar extension. The vulnerability can be exploited remotely and has a publicly available proof-of-concept exploit. [1, 2]
How can this vulnerability impact me? :
This vulnerability impacts confidentiality by allowing attackers to access sensitive files on the affected system through path traversal. Since the exploit can be launched remotely and easily, it poses a risk of unauthorized disclosure of sensitive information. There are no known mitigations or countermeasures currently published, and the vendor did not respond to the disclosure, increasing the risk to users of the affected software. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for requests to the /project API endpoint with suspicious or crafted artifactId parameters that attempt path traversal sequences (e.g., ../). Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Additionally, you can use curl or similar tools to test the endpoint for path traversal by sending crafted requests, for example: curl -v "http://<target>/project?artifactId=../../etc/passwd" to check if arbitrary files can be accessed. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling access to the vulnerable /project API endpoint if possible, implementing input validation or sanitization on the artifactId parameter to prevent path traversal sequences, and monitoring logs for exploitation attempts. Since no official patch or vendor response is available, consider replacing the affected component with an alternative product or applying custom code fixes to validate and sanitize inputs. Additionally, deploying a web application firewall (WAF) to block malicious requests can help reduce risk. [2]