CVE-2025-55988
Directory Traversal in DreamFactory Core RestController Allows Access
Publication date: 2026-03-20
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dreamfactory | dreamfactory_core | 1.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-55988 is a directory traversal vulnerability in the DreamFactory Core v1.0.3 software, specifically in the /Controllers/RestController.php component. The issue arises because the software does not properly sanitize the URI path in service requests, allowing attackers to include directory traversal sequences like ".." in the resource path.'}, {'type': 'paragraph', 'content': 'This flaw enables an attacker with appropriate permissions to manipulate file paths and access or write files outside the intended directories. By exploiting this, an attacker can upload malicious PHP files to web-accessible locations, which can then be executed remotely, leading to remote code execution on the server.'}, {'type': 'paragraph', 'content': 'The vulnerability was fixed by sanitizing the resource path to remove all occurrences of "..", preventing directory traversal attempts.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts if exploited. An attacker who has authenticated access with permission to send POST requests to the file upload endpoint can perform a path traversal attack to upload arbitrary PHP files outside the intended storage directory.
By placing malicious PHP files in web-accessible directories, the attacker can execute arbitrary code on the server remotely. This can lead to full remote code execution, allowing the attacker to run system commands, compromise the server, access sensitive data, or pivot to other parts of the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious POST requests to the /api/v2/files endpoint that include directory traversal sequences such as "../" in the file path.'}, {'type': 'paragraph', 'content': 'A proof of concept involves sending a crafted multipart/form-data POST request to an endpoint like /api/v2/files/../../public/path_trav.php with a file containing PHP code disguised as an SVG element.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts, you can search your web server logs for POST requests to /api/v2/files containing ".." sequences or unusual file paths.'}, {'type': 'list_item', 'content': "Use grep or similar tools to find suspicious requests in logs, for example: grep -E 'POST /api/v2/files/.*/\\.\\.' /var/log/nginx/access.log"}, {'type': 'list_item', 'content': 'Check for newly created or modified PHP files in web-accessible directories such as /opt/dreamfactory/public that were uploaded recently.'}, {'type': 'list_item', 'content': "If you have access to the server, you can run commands like: find /opt/dreamfactory/public -name '*.php' -mtime -7 to find recently modified PHP files."}] [2, 1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade DreamFactory Core to version 1.0.4 or later, where the vulnerability has been fixed by sanitizing the resource path to remove directory traversal sequences.'}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, restrict access to the /api/v2/files endpoint to only trusted authenticated users with minimal permissions.'}, {'type': 'paragraph', 'content': 'Implement network-level controls such as firewall rules or web application firewall (WAF) rules to block requests containing directory traversal patterns like ".." in the URL path.'}, {'type': 'paragraph', 'content': 'Review and tighten file upload permissions and validate file paths on the server side to prevent unauthorized file writes.'}] [2, 1]