What’s Vulnerable › Vulnerabilities

CVE-2025-13266: wwwlike vlife VLifeApi SysFileApi.java create path traversal

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-17 · updated 2026-10-07
• Weakness: CWE-22

Description

A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Affected products

• wwwlike vlife: 2.0.0, 2.0.1

References

• https://github.com/wwwlike/vlife/issues/3
• https://vuldb.com/?ctiid.332601
• https://vuldb.com/?id.332601
• https://vuldb.com/?submit.689436

Get alerted when CVE-2025-13266 or the next vulnerability affects your stack