Executive Summary

[{'type': 'paragraph', 'content': "CVE-2025-15589 is a directory traversal vulnerability in MuYuCMS version 2.7, specifically in the Template Management module's delete_dir_file function within the application/admin/controller/Template.php file."}, {'type': 'paragraph', 'content': 'The vulnerability arises because the parameters \'temn\' and \'tp\' are used to construct filesystem paths without proper validation or sanitization. An authenticated attacker can manipulate these parameters to include directory traversal sequences (like "../../") to escape the intended template directory.'}, {'type': 'paragraph', 'content': 'This allows the attacker to target and recursively delete arbitrary directories and files anywhere on the server, potentially removing critical system files and causing severe damage.'}] [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to recursive deletion of critical system directories and files, resulting in irreversible data loss and denial of service.

It can also cause privilege escalation by removing security configurations or important files, potentially leading to complete system compromise.

Because the deletion is recursive and uncontrolled, a single exploit can remove entire directory trees, amplifying the damage significantly.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying attempts to exploit the directory traversal flaw in the MuYuCMS Template Management module, specifically targeting the `tempdel` method via POST requests to `/admin/template/tempdel` with manipulated `temn` and `tp` parameters containing directory traversal sequences (e.g., "../../../etc/passwd").'}, {'type': 'paragraph', 'content': 'One detection method is to monitor web server logs for suspicious POST requests to `/admin/template/tempdel` that include directory traversal patterns in the parameters.'}, {'type': 'list_item', 'content': 'Example command to search web server logs for suspicious requests (assuming Apache logs):'}, {'type': 'list_item', 'content': "grep -iE 'POST /admin/template/tempdel' /var/log/apache2/access.log | grep -E '\\.\\./|\\.\\.\\\\'"}, {'type': 'list_item', 'content': 'Use Google dorking to identify vulnerable targets by searching for: inurl:application/admin/controller/Template.php'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict path validation on the parameters `temn` and `tp` before any file or directory deletion is performed.

Specifically, verify that the resolved absolute path of the target directory or file is within the allowed template directory to prevent directory traversal.

If possible, restrict or disable the vulnerable `tempdel` functionality until a secure patch or update is available.

Monitor and block suspicious requests attempting directory traversal sequences in the `temn` and `tp` parameters.

Since no vendor response or patch is available, consider replacing the affected component with an alternative product or applying custom fixes to sanitize inputs.

Useful 0 Not Useful 0