What’s Vulnerable › Vulnerabilities

CVE-2025-65879

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-05 · updated 2026-09-25
• Weakness: CWE-22

Description

Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.

Affected products

• yeqifu Warehouse Management System: through 1.2

References

• https://github.com/W000i/vuln/issues/3

Get alerted when CVE-2025-65879 or the next vulnerability affects your stack