CVE-2025-1336 Overview
CVE-2025-1336 is a path traversal vulnerability [CWE-22] in CmsEasy version 7.7.7.9. The flaw resides in the deleteimg_action function within lib/admin/image_admin.php. An authenticated remote attacker can manipulate the imgname argument to traverse the file system and delete files outside the intended image directory. The exploit has been disclosed publicly and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can delete arbitrary files on the CmsEasy host through unsanitized imgname input, potentially disrupting application availability and aiding further compromise.
Affected Products
- CmsEasy 7.7.7.9
- Component: lib/admin/image_admin.php
- Function: deleteimg_action
Discovery Timeline
- 2025-02-16 - CVE-2025-1336 published to NVD
- 2025-02-28 - Last updated in NVD database
Technical Details for CVE-2025-1336
Vulnerability Analysis
The vulnerability is a path traversal flaw in the CmsEasy administrative image management code. The deleteimg_action function accepts an imgname parameter from the HTTP request and uses it to construct a file path for deletion. The function does not sanitize or canonicalize the input, allowing directory traversal sequences such as ../ to escape the intended image directory.
An authenticated user with access to the admin interface can submit crafted requests that resolve to arbitrary files on the server. The attack is launched over the network and requires low privileges. The disclosure note from VulDB indicates the exploit has been published and may be used by opportunistic actors.
While this CVE results in file deletion rather than code execution, removing critical configuration files, session stores, or PHP scripts can lead to denial of service or weaken the security posture of the host. EPSS data places exploitation probability at roughly 0.93%.
Root Cause
The root cause is missing input validation on the imgname parameter inside deleteimg_action. The function trusts user-supplied filenames and passes them directly to filesystem deletion routines. There is no allow-list of legitimate image paths and no resolution check confirming that the final path remains within the designated image directory.
Attack Vector
The attack vector is network-based and requires authenticated access to the CmsEasy administrative panel. An attacker sends a request invoking the deleteimg_action handler with an imgname value containing ../ sequences pointing to a target file. The vulnerable code resolves the path and removes the file. Details are documented in the GitHub PoC for Path Traversal and VulDB entry #295951.
Detection Methods for CVE-2025-1336
Indicators of Compromise
- HTTP requests to CmsEasy admin endpoints invoking deleteimg_action with imgname values containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths.
- Unexpected deletion of files outside the CmsEasy upload or image directories, particularly configuration files and PHP scripts.
- Web server access logs showing administrative actions from IP addresses not associated with legitimate administrators.
Detection Strategies
- Inspect web server logs for query strings or POST bodies referencing deleteimg_action combined with traversal sequences in the imgname parameter.
- Deploy a Web Application Firewall (WAF) rule matching path traversal patterns on requests targeting lib/admin/image_admin.php.
- Compare filesystem state of the CmsEasy installation against a known-good baseline to identify files removed outside the image directory.
Monitoring Recommendations
- Enable file integrity monitoring on the CmsEasy webroot, with priority on configuration files, install.php, and authentication scripts.
- Forward webserver and PHP error logs to a centralized logging platform and alert on traversal patterns targeting admin handlers.
- Track failed and successful administrative authentication events to detect credential abuse preceding exploitation.
How to Mitigate CVE-2025-1336
Immediate Actions Required
- Restrict access to the CmsEasy administrative interface using IP allow-lists, VPN access, or reverse proxy authentication.
- Audit and rotate administrator credentials, and enforce strong passwords to reduce the risk of unauthorized authenticated access.
- Review web server and application logs for prior exploitation attempts referencing deleteimg_action and traversal sequences.
- Back up the CmsEasy installation and database to enable recovery if files have been removed.
Patch Information
No vendor patch is available. The CVE record notes that the vendor was contacted but did not respond to the disclosure. Operators should evaluate whether continued use of CmsEasy 7.7.7.9 is acceptable given the absence of vendor support. Track the VulDB advisory #295951 for updates.
Workarounds
- Apply a custom code patch to lib/admin/image_admin.php that validates imgname against a strict allow-list of filename characters and rejects any input containing path separators or traversal sequences.
- Add a server-side check using realpath() to confirm the resolved deletion target remains within the designated image directory before invoking unlink().
- Deploy WAF signatures blocking requests to the admin handler that contain ../, ..\, or encoded equivalents in the imgname parameter.
- Restrict filesystem permissions of the PHP process so it cannot delete files outside the image upload directory.
# Example WAF rule pattern (ModSecurity-style) blocking traversal in imgname
SecRule ARGS:imgname "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
"id:1003361,phase:2,deny,status:403,log,msg:'CVE-2025-1336 CmsEasy path traversal attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
