Summary
generated automatically from NVD dataYiShaAdmin versions 2.2 through 3.1 have an unauthenticated path traversal flaw (CWE-22) in the /admin/File/DownloadFile endpoint. By sending crafted GET requests with directory traversal sequences in the filePath parameter, and optionally setting the delete parameter, an attacker can read or remove arbitrary system files such as etc/passwd. The description says it is fixed in commit 025b062, and the CVSS v3.1 score is 9.1 (CRITICAL).
NVD description
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 oct. 2026
- Updated
- 22 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.