CVE-2025-29592 Path traversal in n/a
An attacker can exploit a directory traversal vulnerability in the ProcedureController to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29592?
CVE-2025-29592 is a medium-severity path traversal vulnerability in n/a, published on 10 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.
Weakness: CWE-22
Which versions are affected by CVE-2025-29592?
It affects 1 product.
Products include Aaluoxiang Oa System.
How do I fix CVE-2025-29592?
No fix has been published for CVE-2025-29592 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-29592 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29592 exists.
Other vulnerabilities in n/a
- CVE-2025-44033 SQL injection in n/a
- CVE-2025-44034 SQL injection in n/a
- CVE-2025-6829 aaluoxiang oa_system External Address Book outAddress sql injection
- CVE-2025-5544 aaluoxiang oa_system UserpanelController.java image path traversal
- CVE-2025-5545 aaluoxiang oa_system ProcedureController.java image path traversal
Sources
Also known as GHSA-rqvp-8xwh-mcm4.