CVE-2025-65878

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.

• CWE-22

• https://github.com/W000i/vuln/issues/2Exploit, Issue Tracking, Third Party Advisory

Published

Dec 5, 2025

Last Modified

Sep 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6586The Download Plugin plugin for WordPress is vulnerable to ar…7.2
• CVE-2025-65865An integer overflow in eProsima Fast-DDS v3.3 allows attacke…7.5
• CVE-2025-65868XML external entity (XXE) injection in eyoucms v1.7.1 allows…7.5
• CVE-2025-6587System environment variables are recorded in Docker Desktop …5.2
• CVE-2025-65875An arbitrary file upload vulnerability in the AddFont() func…9.8
• CVE-2025-65877Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017…7.5
• CVE-2025-65879Warehouse Management System 1.2 contains an authenticated ar…8.1
• CVE-2025-6588The FunnelCockpit plugin for WordPress is vulnerable to Refl…6.1
• CVE-2025-65881Sourcecodester Zoo Management System v1.0 is vulnerable to C…6.1
• CVE-2025-65882An issue was discovered in openmptcprouter thru 0.64 in file…9.8
• CVE-2025-65883A vulnerability has been identified in Genexis Platinum P441…8.4
• CVE-2025-65885An issue was discovered in the Delight Custom Firmware (CFW)…5.1