CVE-2025-13246: ShopSuite ModulithShop Path Traversal Flaw

CVE-2025-13246 Overview

CVE-2025-13246 is a path traversal vulnerability [CWE-22] in shsuishang ShopSuite ModulithShop affecting commits up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. The flaw resides in the JwtAuthenticationFilter function within src/main/java/com/suisung/shopsuite/common/security/JwtAuthenticationFilter.java. Remote attackers with low privileges can manipulate request paths to bypass authentication checks or access resources outside the intended directory scope. The vendor uses a rolling release model, so no specific vulnerable or fixed version numbers exist. A public exploit has been disclosed, increasing the likelihood of opportunistic exploitation.

Critical Impact
Remote attackers can leverage path traversal in the JWT authentication filter to bypass access controls or reach unintended endpoints in ModulithShop deployments.

Affected Products

shsuishang ShopSuite ModulithShop (rolling release up to commit 45a99398cec3b7ad7ff9383694f0b53339f2d35a)
Component: JwtAuthenticationFilter.java under src/main/java/com/suisung/shopsuite/common/security/
Deployments exposing the ModulithShop web application to network-accessible clients

Discovery Timeline

2025-11-16 - CVE-2025-13246 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13246

Vulnerability Analysis

The vulnerability sits inside the JWT authentication filter that ModulithShop uses to gate protected routes. The filter inspects incoming request paths to determine whether authentication is required. Because path handling does not properly normalize traversal sequences, attackers can craft requests that appear to target permitted resources while actually reaching restricted endpoints. This class of flaw, tracked as CWE-22, converts a security decision point into an access-control bypass. Exploitation requires network access and a low-privilege authenticated context, and no user interaction is needed. The impact scope is limited to the ModulithShop application, but any endpoint the filter fails to guard becomes reachable.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory within JwtAuthenticationFilter. The filter compares raw or insufficiently canonicalized request URIs against allow-lists or protected patterns. Attackers submitting URIs containing traversal sequences such as ..%2f or duplicated slashes can cause the filter's matching logic to diverge from the routing logic downstream. When the two components interpret the path differently, the filter permits requests that Spring's dispatcher then routes to protected controllers without token validation.

Attack Vector

The attack originates over the network against any exposed ModulithShop HTTP endpoint. An authenticated user with low privileges, or in some deployments an unauthenticated actor able to reach public endpoints, submits crafted URIs to slip past the JWT check. Because a public proof of concept exists on the vendor's GitHub issue tracker, weaponization requires minimal skill. The vulnerability manifests entirely in request handling. See the GitHub Issue #1 Discussion and VulDB entry #332580 for the disclosed reproduction details.

Detection Methods for CVE-2025-13246

Indicators of Compromise

Web server access logs containing encoded traversal sequences such as ..%2f, %2e%2e/, or ..;/ targeting ModulithShop URIs
Requests to protected API endpoints under /api/ or admin paths that lack a valid Authorization: Bearer header yet return 200 responses
Repeated 4xx-to-2xx transitions on the same client IP as attackers iterate traversal payloads

Detection Strategies

Deploy WAF signatures that decode and normalize URIs before evaluating them against ModulithShop route allow-lists
Enable verbose logging in JwtAuthenticationFilter to record the raw request URI, resolved handler, and authentication outcome for correlation
Alert on discrepancies between the filter's authentication decision and the controller ultimately invoked by the dispatcher

Monitoring Recommendations

Ingest ModulithShop application and reverse-proxy logs into a centralized analytics pipeline and hunt for traversal patterns
Track baseline request-per-endpoint volumes and flag sudden spikes on administrative or account-management routes
Review authentication failure and success ratios per source IP for anomalies consistent with filter bypass probing

How to Mitigate CVE-2025-13246

Immediate Actions Required

Update ModulithShop to a commit newer than 45a99398cec3b7ad7ff9383694f0b53339f2d35a once the maintainers publish a fix in the rolling release
Restrict network exposure of ModulithShop administrative endpoints to trusted management networks or VPN users
Audit application logs for evidence of traversal-based probes since the CVE publication date

Patch Information

The vendor distributes ModulithShop through a rolling release model, so no discrete patched version identifier exists. Operators should pull the latest commit from the upstream repository once the maintainers acknowledge the fix in the GitHub issue tracker. Rebuild and redeploy the application, then confirm JwtAuthenticationFilter.java performs URI canonicalization before authorization decisions.

Workarounds

Place a reverse proxy in front of ModulithShop that normalizes and rejects request URIs containing traversal sequences before they reach the application
Configure WAF rules that block encoded .., ;, and double-slash patterns in paths targeting protected controllers
Temporarily require authentication at the proxy layer for all /api/ and administrative routes until the upstream fix is deployed

bash

# Example NGINX guard placed in front of ModulithShop
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|\.\.;)") {
        return 400;
    }
    proxy_pass http://modulithshop_backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}