CVE-2025-12626
BaseFortify
Publication date: 2025-11-03
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jeecgboot | jeewx-boot | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-12626 is a path traversal vulnerability in the jeecgboot jeewx-boot project, specifically in the getImgUrl function of WxActGoldeneggsPrizesController.java. The vulnerability allows attackers to manipulate the imgurl parameter to perform directory traversal and read arbitrary files on the server. Although initial fixes attempted to sanitize input by removing special characters and sequences, attackers bypassed these checks by encoding spaces as %20, reconstructing traversal sequences after decoding. This flaw enables unauthorized reading of sensitive files remotely. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to read arbitrary files on the affected server remotely without authorization. This can lead to exposure of sensitive information such as configuration files, user data, or system files (e.g., /etc/passwd or Windows/win.ini). Such unauthorized access can compromise the confidentiality of the system and potentially aid further attacks. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP GET requests to the vulnerable endpoint for suspicious path traversal patterns, especially those using encoded spaces (%20) to bypass sanitization. For example, look for requests targeting the endpoint `/goldeneggs/back/wxActGoldeneggsPrizes/getImgUrl` with parameters like `imgurl=/%20.%20.%20/.../etc/passwd` or similar traversal sequences. Network or web server logs can be searched using commands like: `grep 'getImgUrl' /var/log/nginx/access.log | grep -E '(%20|\.\./)'` to find potential exploit attempts. Additionally, testing the endpoint with crafted requests that include encoded traversal sequences can help confirm vulnerability presence. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict input validation and sanitization on the `imgurl` parameter to prevent directory traversal sequences, especially those using encoded characters like `%20`. Avoid relying solely on removing whitespace after URL decoding, as attackers can bypass this. Applying patches or updates from the developers that fix the sanitization logic is critical. If patches are not available, consider blocking or filtering suspicious requests at the web server or firewall level targeting the vulnerable endpoint. Restricting file access permissions on the server to limit exposure of sensitive files can also reduce risk. [1, 2]