CVE-2025-14520 - baowzh hfly delfile path traversal

Back Back to CVE browser

MEDIUM

baowzh hfly delfile path traversal

Published Dec 11, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.64%

Description

A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/datafile/delfile. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Baowzh Product Hfly Default
unknown
Affected

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Baowzh	Hfly	unknown	Affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202690
Advisory
https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20delfile%20filename%20Arbitrary%20file%20delete.md
broken-linkexploitBroken Link
https://vuldb.com/?ctiid.335858
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.335858
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.702948
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202690		Advisory
https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20delfile%20filename%20Arbitrary%20file%20delete.md		broken-linkexploitBroken Link
https://vuldb.com/?ctiid.335858		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.335858		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.702948		third-party-advisoryThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulDB

Published Dec 11, 2025

Updated Dec 11, 2025

Reserved Dec 11, 2025

Link CVE-2025-14520

CISA Vulnrichment

Updated Dec 11, 2025

NVD

Status Analyzed

Modified Oct 7, 2026

Link CVE-2025-14520

Red Hat

No data

ENISA EUVD

Assigner VulDB

Published Dec 11, 2025

Updated Dec 11, 2025

Link EUVD-2025-202690

GitHub

No data