MEDIUM
Dreampie Resty HttpClient HttpClient.java request path traversal
Published Nov 20, 2025
6.3
MEDIUMCVSS 4.0
EPSS 0.74%
Description
A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
-
- Version 1.3.1.SNAPSHOTStatusaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (7)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198256 Advisory
- https://github.com/Xzzz111/exps/blob/main/archives/Resty-PathTraversal-01/cve_application.md exploitThird Party Advisory
- https://github.com/advisories/GHSA-cv3m-hxpc-4hvm Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13435
- https://vuldb.com/?ctiid.332979 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.332979 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.687603 third-party-advisoryThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198256 | Advisory | |
| https://github.com/Xzzz111/exps/blob/main/archives/Resty-PathTraversal-01/cve_application.md | exploitThird Party Advisory | |
| https://github.com/advisories/GHSA-cv3m-hxpc-4hvm | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2025-13435 | ||
| https://vuldb.com/?ctiid.332979 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.332979 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.687603 | third-party-advisoryThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Nov 20, 2025
Updated Nov 20, 2025
Reserved Nov 19, 2025
Link CVE-2025-13435
CISA Vulnrichment
Updated Nov 20, 2025
ENISA EUVD
EUVD-2025-198256 GHSA-CV3M-HXPC-4HVM Assigner VulDB
Published Nov 20, 2025
Updated Nov 20, 2025
Exploited since n/a
Link EUVD-2025-198256