CVE-2025-11336: Four-Faith Water Platform Path Traversal

CVE-2025-11336 Overview

CVE-2025-11336 is a path traversal vulnerability [CWE-22] in the Four-Faith Water Conservancy Informatization Platform through version 2.2. The flaw resides in the handling of the fileName parameter within the /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do endpoint. Remote attackers can manipulate this parameter to traverse outside the intended directory and read arbitrary files on the host. The exploit has been publicly disclosed. The vendor was contacted before disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can read sensitive files from the underlying server, exposing configuration data, credentials, and application source code.

Affected Products

Four-Faith Water Conservancy Informatization Platform versions up to and including 2.2

Discovery Timeline

2025-10-06 - CVE-2025-11336 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11336

Vulnerability Analysis

The vulnerability is a classic path traversal issue [CWE-22] affecting a file download handler in the platform. The endpoint /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do uses a semicolon parameter and directory-traversal segments to reach the download.do action while potentially bypassing URL-based access controls.

The fileName argument is not properly canonicalized or restricted to a whitelisted directory. Attackers supply traversal sequences such as ../ to escape the intended file base path and reference arbitrary locations on the file system.

Because the request is network-reachable and requires no authentication or user interaction, exploitation is straightforward. The scope is limited to confidentiality — file read only — with no integrity or availability impact reported. EPSS data indicates a probability of 0.64% for near-term exploitation activity.

Root Cause

The root cause is insufficient input validation on the fileName parameter passed to aloneReport/download.do. The handler concatenates user input into a file system path without normalizing traversal sequences or enforcing a base directory constraint. Use of the ;otherlogout.do path parameter suggests the request also evades authentication filters that match on URL suffix.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable endpoint with a fileName value containing directory traversal sequences. The server resolves the path and returns the contents of the target file. No credentials or user interaction are required. Typical targets include application configuration files, database connection strings, private keys, and operating system files readable by the web application user.

For technical details, refer to the GitHub CVE Issue Tracker and VulDB entry #327219.

Detection Methods for CVE-2025-11336

Indicators of Compromise

HTTP requests to /aloneReport/download.do containing traversal patterns such as ../, ..%2f, or encoded variants in the fileName parameter
Requests using the ;otherlogout.do matrix parameter to bypass authentication filters
Outbound file transfers containing sensitive files such as web.xml, application.properties, /etc/passwd, or private keys
Repeated download.do requests from a single source IP within a short window

Detection Strategies

Inspect web server and reverse proxy access logs for URL patterns matching download.do combined with ../ sequences or URL-encoded traversal
Deploy web application firewall (WAF) rules that reject requests with directory traversal payloads in query parameters
Correlate anomalous file read patterns from the web application process against baseline behavior
Alert on requests using semicolon path parameters (;otherlogout.do) which suggest filter evasion attempts

Monitoring Recommendations

Continuously monitor HTTP traffic to Four-Faith platform endpoints for path traversal signatures
Log and review all download.do requests including full query strings for forensic analysis
Track file access events from the web application service account for reads outside expected directories
Aggregate access logs into a centralized SIEM to correlate scanning behavior across multiple assets

How to Mitigate CVE-2025-11336

Immediate Actions Required

Restrict network access to the Four-Faith Water Conservancy Informatization Platform to trusted management networks only
Deploy WAF rules blocking path traversal sequences and semicolon-based URL matrix parameters on download.do endpoints
Audit web server logs for prior exploitation attempts against the /aloneReport/download.do path
Rotate credentials, API keys, and certificates that may have been readable through the application file system

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch has been published. The vendor did not respond to disclosure attempts. Organizations should apply compensating controls and monitor vendor communications for future security updates.

Workarounds

Place the platform behind a reverse proxy that normalizes URLs and rejects traversal sequences before requests reach the application
Enforce filesystem-level permissions so the web application service account cannot read sensitive OS files or credentials outside its working directory
Disable or block the aloneReport/download.do endpoint at the proxy layer if the reporting feature is not required
Segment the platform on an isolated network zone with strict egress filtering to prevent data exfiltration

bash

# Example nginx rule to block traversal attempts on download.do
location ~* /aloneReport/download\.do {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    if ($request_uri ~* ";[a-zA-Z]+\.do") {
        return 403;
    }
    proxy_pass http://backend;
}