CVE-2025-15432 yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal
Remote attackers can exploit a path traversal vulnerability in the file download function to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15432?
CVE-2025-15432 is a medium-severity path traversal vulnerability in yeqifu carRental, published on 2 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Weakness: CWE-22
Which versions are affected by CVE-2025-15432?
It affects 1 product.
Products include Yeqifu Carrental.
How do I fix CVE-2025-15432?
No fix has been published for CVE-2025-15432 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-15432 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15432 exists.
Sources
Also known as GHSA-c9rh-2qq3-frxv.