CVE-2025-13266: wwwlike vlife Path Traversal Vulnerability

CVE-2025-13266 Overview

CVE-2025-13266 is a path traversal vulnerability [CWE-22] in wwwlike vlife versions up to 2.0.1. The flaw resides in the create function of vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java within the VLifeApi component. Attackers can manipulate the fileName argument to traverse the file system outside the intended upload directory. The vulnerability is exploitable remotely without authentication, and the exploit has been publicly disclosed.

Critical Impact
Unauthenticated remote attackers can read or write files outside the intended directory scope by supplying crafted fileName values, potentially exposing sensitive application data.

Affected Products

wwwlike vlife versions up to and including 2.0.1
Component: VLifeApi (SysFileApi.java)
Function: create in vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java

Discovery Timeline

2025-11-17 - CVE-2025-13266 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13266

Vulnerability Analysis

The vulnerability exists in the vlife framework, an open-source Java-based low-code development platform. The create function in SysFileApi.java accepts a fileName parameter from remote clients without proper sanitization. Attackers supply directory traversal sequences such as ../ to escape the intended file storage directory. This allows unauthorized file operations across the host file system.

Because the endpoint is network-accessible and requires no authentication, exploitation is straightforward. The Exploit Prediction Scoring System (EPSS) reflects a modest probability of exploitation activity in the near term, but the public availability of exploit details raises the practical risk.

Root Cause

The root cause is missing input validation on the fileName parameter before it is used in file system operations. The application does not canonicalize the resolved path or verify that the target file resides within an approved directory. This omission enables directory traversal via ../ or absolute path sequences.

Attack Vector

A remote attacker sends a crafted HTTP request to the vulnerable VLifeApi endpoint. The fileName parameter contains path traversal sequences pointing outside the designated upload directory. The application writes or creates files at the attacker-controlled path, which can be leveraged to overwrite configuration files, drop web shells, or access sensitive resources depending on server permissions.

No verified exploit code is published. Technical discussion is available in the GitHub Issue #3 and the VulDB entry #332601.

Detection Methods for CVE-2025-13266

Indicators of Compromise

HTTP requests to VLifeApi file creation endpoints containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the fileName parameter
Unexpected files created outside the configured upload directory of the vlife application
Web server logs showing POST requests with anomalous fileName values referencing system paths such as /etc/, WEB-INF/, or C:\Windows\

Detection Strategies

Inspect application and reverse proxy logs for requests targeting SysFileApi endpoints with suspicious fileName payloads
Deploy WAF signatures that flag path traversal patterns in JSON and form-encoded request bodies
Monitor file system activity on the application host for writes outside the vlife upload path

Monitoring Recommendations

Alert on process activity in which the Java application writes to sensitive directories such as web root or configuration paths
Correlate unauthenticated POST requests to file upload endpoints with subsequent file creation events
Enable audit logging on the vlife application server and forward logs to a centralized analytics platform for retention and search

How to Mitigate CVE-2025-13266

Immediate Actions Required

Restrict network access to the vlife application to trusted networks until a patch is applied
Place the application behind a WAF configured to block path traversal patterns in request bodies
Audit the file system for unauthorized files created in or outside the vlife upload directory

Patch Information

No official vendor patch is referenced in the CVE record. Users should monitor the vlife GitHub repository for an official fix and upgrade to any release beyond 2.0.1 once available. Interim mitigation requires custom hardening of the SysFileApi.create handler.

Workarounds

Modify the create handler to reject fileName values containing .., /, \, or null bytes
Canonicalize the resolved file path and verify it starts with the approved upload directory before writing
Enforce a strict allowlist of file name characters, such as alphanumerics, dashes, and underscores
Run the application under a low-privilege service account to limit the impact of successful traversal

bash

# Example nginx WAF-style rule to block path traversal in fileName parameter
location /sys/file/ {
    if ($request_body ~* "fileName\"\s*:\s*\"[^\"]*(\.\.|%2e%2e)") {
        return 403;
    }
    proxy_pass http://vlife_backend;
}