CVE-2025-15449 cld378632668 JavaMall MinioController.java delete path traversal
Remote attackers can exploit a path traversal flaw in the MinioController delete function to read or modify arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15449?
CVE-2025-15449 is a medium-severity path traversal vulnerability in cld378632668 JavaMall, published on 5 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-22
Which versions are affected by CVE-2025-15449?
It affects 1 product.
Products include Cld378632668 Javamall.
How do I fix CVE-2025-15449?
No fix has been published for CVE-2025-15449 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-15449 being exploited?
There is no known exploitation of CVE-2025-15449 in the wild and no public exploit code.
Other vulnerabilities in cld378632668 JavaMall
Sources
Also known as GHSA-3qff-j79f-jf26.