CVE-2025-10232 Overview
CVE-2025-10232 is a path traversal vulnerability [CWE-22] affecting 299ko content management system versions up to 2.0.0. The flaw resides in the getSentDir and delete functions within plugin/filemanager/controllers/FileManagerAPIController.php. Authenticated attackers can manipulate input parameters to traverse directory boundaries and access or delete files outside the intended file manager scope. The vulnerability is exploitable remotely over the network. According to the disclosure record, the vendor was contacted early but did not respond, and a proof-of-concept has been published.
Critical Impact
Remote authenticated attackers can traverse the server file system to read or delete arbitrary files accessible to the web server process.
Affected Products
- 299ko CMS versions up to and including 2.0.0
- plugin/filemanager/controllers/FileManagerAPIController.php component
- Deployments exposing the file manager plugin to authenticated users
Discovery Timeline
- 2025-09-10 - CVE-2025-10232 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10232
Vulnerability Analysis
The vulnerability affects the file manager plugin shipped with 299ko, a lightweight PHP-based CMS. The getSentDir and delete methods in FileManagerAPIController.php accept user-controlled path parameters without properly normalizing or validating them against the intended base directory. Attackers with low-privilege authentication can supply traversal sequences such as ../ to escape the file manager root. This allows read access via getSentDir and destructive file removal via delete against locations outside the permitted directory tree. Because the endpoints are reachable over HTTP, no local access to the server is required.
Root Cause
The underlying flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The controller concatenates or forwards user-supplied directory names into file system operations without canonicalizing the resulting path and confirming it remains within the file manager's designated storage root. Missing input sanitization on directory parameters lets traversal metacharacters reach the underlying PHP file APIs.
Attack Vector
Exploitation requires network access to the 299ko web interface and a valid low-privilege account able to reach the file manager plugin. An attacker issues crafted HTTP requests to the affected API endpoints, supplying directory or file parameters containing ../ sequences to reference paths above the plugin's root. The delete handler can then remove files the web server user has write access to, while getSentDir can enumerate arbitrary directories. A public proof-of-concept is referenced in the GitHub disclosure and VulDB entry #323501.
Detection Methods for CVE-2025-10232
Indicators of Compromise
- HTTP requests to plugin/filemanager/controllers/FileManagerAPIController.php containing ..%2F, ../, or URL-encoded traversal sequences in directory parameters
- Unexpected file deletions in directories outside the 299ko file manager root, particularly in configuration or plugin folders
- Access log entries invoking getSentDir or delete actions from unusual client IPs or user agents
Detection Strategies
- Inspect web server access logs for requests to the file manager API endpoints that include path traversal characters in query strings or POST bodies
- Enable PHP file system auditing or use auditd on Linux to record unlink and readdir calls made by the web server user against unexpected paths
- Correlate authenticated session identifiers with file operations to identify low-privilege accounts performing sensitive file access
Monitoring Recommendations
- Alert on any HTTP 200 responses to FileManagerAPIController.php that contain directory listings referencing system paths
- Baseline normal file manager activity and flag deviations such as delete operations targeting .php or configuration files
- Forward web and file system telemetry to a centralized analytics platform for retention and correlation
How to Mitigate CVE-2025-10232
Immediate Actions Required
- Restrict network access to the 299ko administrative interface using firewall rules, VPN, or IP allowlisting until a patch is available
- Disable the file manager plugin if it is not required for daily operations
- Rotate credentials for all 299ko accounts and review recent audit logs for signs of traversal activity
- Back up site content and verify integrity of files under the web root
Patch Information
No vendor patch is currently referenced in the CVE record. The disclosure notes that the vendor did not respond to early notification. Administrators should monitor the 299ko project repository and the VulDB advisory for future updates and apply fixes as soon as they are published.
Workarounds
- Remove or rename the plugin/filemanager directory to disable the vulnerable controller entirely
- Deploy a web application firewall rule that blocks requests to FileManagerAPIController.php containing .. sequences or encoded equivalents
- Enforce least-privilege file system permissions so the PHP process cannot delete files outside the intended storage directory
- Limit accounts with access to the file manager to trusted administrators only
# Example WAF rule (ModSecurity) to block traversal against the vulnerable endpoint
SecRule REQUEST_URI "@contains FileManagerAPIController.php" \
"chain,phase:2,deny,status:403,id:1002325,\
msg:'CVE-2025-10232 path traversal attempt against 299ko file manager'"
SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
