CVE-2025-1335: Cmseasy Path Traversal Vulnerability

CVE-2025-1335 Overview

CVE-2025-1335 is a path traversal vulnerability in CmsEasy 7.7.7.9, an open-source content management system. The flaw resides in the deleteimg_action function within the lib/admin/file_admin.php library. An authenticated remote attacker can manipulate the imgname parameter to traverse directories and delete files outside the intended image directory. The exploit details have been disclosed publicly, and the vendor did not respond to disclosure attempts, leaving the issue unpatched at publication.

Critical Impact
Authenticated remote attackers can delete arbitrary files on the host filesystem by abusing the imgname parameter, potentially impacting CMS integrity and availability.

Affected Products

CmsEasy 7.7.7.9
CmsEasy administrative file management module (lib/admin/file_admin.php)
Deployments exposing the admin interface to untrusted networks

Discovery Timeline

2025-02-16 - CVE-2025-1335 published to the National Vulnerability Database
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-1335

Vulnerability Analysis

The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The deleteimg_action handler in lib/admin/file_admin.php accepts a user-supplied imgname parameter and uses it to locate and delete an image file. The handler fails to canonicalize the supplied path or restrict it to the intended image directory.

An attacker who supplies traversal sequences such as ../ in the imgname value can break out of the expected directory. The application then resolves the path relative to the application root and operates on whichever file the attacker references. Because the action performs file deletion, successful exploitation can remove configuration files, installation markers, or other resources the web server can write to.

Exploitation requires network access to the admin endpoint and low-privilege authentication, since file_admin.php lives under the administrative interface. The attack is remote, requires no user interaction, and the public disclosure includes proof-of-concept details.

Root Cause

The root cause is missing input validation and path normalization on the imgname parameter before it is passed to file deletion logic. The function does not enforce a base directory, does not strip traversal sequences, and does not verify the resolved path remains within the intended image folder.

Attack Vector

The attack vector is network-based. An authenticated user issues a crafted HTTP request to the deleteimg_action endpoint with an imgname value containing directory traversal sequences. The request is processed by lib/admin/file_admin.php, which constructs a filesystem path from the attacker-controlled value and invokes a file deletion routine.

A technical write-up and proof-of-concept are available in the public GitHub PoC for CmsEasy Path Traversal and the VulDB advisory.

Detection Methods for CVE-2025-1335

Indicators of Compromise

HTTP requests to administrative endpoints containing deleteimg_action in the action or query parameters
Request parameters carrying imgname values with ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes
Unexpected file deletions in non-image directories under the CmsEasy installation path
Web server access logs showing repeated requests to file_admin.php from a single source

Detection Strategies

Inspect web server and application logs for imgname parameter values containing traversal characters or encoded equivalents
Deploy web application firewall (WAF) rules that block path traversal patterns on requests targeting file_admin.php
Correlate administrative authentication events with subsequent file deletion activity on the underlying filesystem

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the CmsEasy web root and configuration directories to alert on unexpected deletions
Forward web server and PHP error logs to a centralized log platform and alert on requests to deleteimg_action from non-administrative source IPs
Monitor the rate of administrative API calls and flag anomalous spikes targeting file management endpoints

How to Mitigate CVE-2025-1335

Immediate Actions Required

Restrict network access to the CmsEasy administrative interface using IP allowlists, VPN, or reverse-proxy authentication
Audit existing administrative accounts and enforce strong, unique credentials with multi-factor authentication where supported
Review the web root for missing or modified files that may indicate prior exploitation of the deleteimg_action endpoint

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted before public release but did not respond. Operators should monitor the VulDB entry and the CmsEasy project for any subsequent updates and consider migrating away from the affected version if no fix is published.

Workarounds

Apply a virtual patch at the WAF or reverse proxy that rejects requests to file_admin.php containing .., %2e%2e, or absolute path prefixes in the imgname parameter
Remove or rename lib/admin/file_admin.php if the image deletion functionality is not required in the deployment
Set restrictive filesystem permissions so the PHP process cannot delete files outside the intended image directory
Place the administrative interface behind an additional authentication layer such as HTTP basic auth at the web server level

bash

# Example NGINX rule to block traversal sequences in imgname parameter
location ~* /lib/admin/file_admin\.php$ {
    if ($arg_imgname ~* "(\.\./|\.\.\\|%2e%2e|^/)") {
        return 403;
    }
    # Restrict to administrative source networks
    allow 10.0.0.0/8;
    deny all;
}