CVE-2025-1106: Cmseasy Path Traversal Vulnerability

CVE-2025-1106 Overview

CVE-2025-1106 is a path traversal vulnerability in CmsEasy 7.7.7.9. The flaw resides in the deletedir_action and restore_action functions within the lib/admin/database_admin.php library. Attackers with low-privileged access can manipulate path parameters to traverse the file system outside of intended directories. The vulnerability is remotely exploitable over the network and has been publicly disclosed. The vendor was contacted before public disclosure but did not respond. This weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated remote attackers can traverse directories to delete or restore arbitrary files on the CmsEasy host, disrupting integrity and availability of the application.

Affected Products

CmsEasy 7.7.7.9
lib/admin/database_admin.php library component
Deployments exposing the admin interface over the network

Discovery Timeline

2025-02-07 - CVE-2025-1106 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1106

Vulnerability Analysis

The vulnerability affects the CmsEasy content management system, a PHP-based CMS. The deletedir_action and restore_action functions in lib/admin/database_admin.php accept user-controlled input used to reference directory paths for deletion or restoration operations. The functions do not sufficiently validate or canonicalize the supplied path, allowing traversal sequences such as ../ to escape the intended directory scope.

An attacker with low-privileged authenticated access to the administrative interface can supply crafted path values to reach files outside the expected working directory. Because the affected actions perform destructive or restorative operations, exploitation can compromise integrity and availability of application data. The exploit details have been published publicly, increasing the likelihood of opportunistic use against exposed installations.

Root Cause

The root cause is missing input sanitization on directory path parameters passed to deletedir_action and restore_action. The library does not enforce a canonical base directory or reject traversal sequences before performing file system operations, violating the [CWE-22] principle of restricting pathnames to intended directories.

Attack Vector

Exploitation occurs over the network against the CmsEasy admin endpoint. The attacker requires low-privileged authentication but no user interaction. By submitting a request with a manipulated directory parameter to the vulnerable action, the attacker can trigger file operations on paths outside the intended scope. Technical details and a proof of concept are published in the GitHub PoC Repository and referenced by VulDB #294939.

Detection Methods for CVE-2025-1106

Indicators of Compromise

HTTP requests to CmsEasy admin endpoints invoking deletedir_action or restore_action with path parameters containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected file deletions or restorations outside the CmsEasy application directory tree.
Web server access logs showing authenticated admin sessions issuing directory operations against non-standard paths.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query and body parameters for path traversal patterns targeting database_admin.php.
Correlate authenticated admin actions with file system change events on the CmsEasy host to surface out-of-scope modifications.
Baseline legitimate directory operations performed by the CMS and alert on deviations, particularly involving parent-directory references.

Monitoring Recommendations

Enable verbose access logging on the CmsEasy admin panel and forward logs to a centralized analytics platform for retention and searchability.
Monitor file integrity on directories adjacent to the CmsEasy installation, including configuration, uploads, and backup paths.
Alert on failed and successful admin authentications followed by requests to lib/admin/database_admin.php.

How to Mitigate CVE-2025-1106

Immediate Actions Required

Restrict network access to the CmsEasy admin interface using IP allow-lists, VPN, or reverse-proxy authentication.
Audit administrative accounts and rotate credentials for any low-privileged users who could invoke the vulnerable actions.
Review web server and application logs for prior invocations of deletedir_action or restore_action containing traversal sequences.
Take file system backups of the CmsEasy deployment before applying any remediation.

Patch Information

No vendor patch or advisory has been published. The VulDB entry notes that the vendor was contacted early about this disclosure but did not respond. Organizations running CmsEasy 7.7.7.9 should treat the software as unpatched and prioritize compensating controls, or evaluate migration to an alternative CMS with an active security response process.

Workarounds

Block requests to lib/admin/database_admin.php at the reverse proxy or WAF when the request parameters contain .., %2e%2e, or absolute path prefixes.
Enforce operating-system-level permissions so the PHP runtime user cannot write to directories outside the CmsEasy application root.
Disable or remove the deletedir_action and restore_action handlers if directory management features are not required in the deployment.

bash

# Example nginx rule to block traversal patterns against the vulnerable file
location ~* /lib/admin/database_admin\.php$ {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    # Restrict admin access to trusted networks
    allow 10.0.0.0/8;
    deny all;
}