CVE-2025-14521: Baowzh Hfly Path Traversal Flaw

CVE-2025-14521 Overview

CVE-2025-14521 is a path traversal vulnerability [CWE-22] in the baowzh hfly PHP-based travel website content management system. The flaw resides in the /admin/index.php/datafile/download endpoint, where the filename argument is not properly sanitized before being used in file operations. An authenticated remote attacker can supply traversal sequences to read arbitrary files from the underlying server. The exploit has been disclosed publicly. The vendor uses a rolling release system and did not respond to disclosure attempts, so no fixed version is identified. The affected code state extends through commit 638ff9abe9078bc977c132b37acbe1900b63491c.

Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the web server process, including configuration files, credentials, and source code.

Affected Products

baowzh hfly (PHP-based travel website CMS)
All revisions up to and including commit 638ff9abe9078bc977c132b37acbe1900b63491c
Rolling release: no fixed version published by the vendor

Discovery Timeline

2025-12-11 - CVE-2025-14521 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-14521

Vulnerability Analysis

The vulnerability affects the file download handler exposed at /admin/index.php/datafile/download in the hfly administration interface. The handler accepts a user-controlled filename parameter and uses it to locate and return file contents. The application does not normalize the path or restrict access to an intended base directory.

An attacker with low-privilege authenticated access to the admin interface can submit traversal sequences such as ../ in the filename parameter to escape the expected directory. The web server process then returns the contents of files outside the intended scope. Targets typically include PHP configuration files, database credentials, session storage, and operating system files like /etc/passwd.

The attack is performed over the network with low complexity. The scope is limited to confidentiality of files readable by the web server account, with no direct integrity or availability impact reported.

Root Cause

The root cause is missing input validation on the filename parameter. The download routine concatenates the attacker-controlled value into a filesystem path without canonicalization or allow-list enforcement. This is a classic improper limitation of a pathname to a restricted directory weakness, categorized as [CWE-22].

Attack Vector

Exploitation requires network access to the /admin/index.php endpoint and valid administrative or operator credentials. The attacker issues a crafted HTTP request supplying traversal payloads in the filename parameter. The server returns the contents of the targeted file in the HTTP response. Public proof-of-concept material is available in the GitHub PoC Repository.

No verified exploit code is reproduced here. Refer to the VulDB entry #335859 for additional technical context.

Detection Methods for CVE-2025-14521

Indicators of Compromise

HTTP requests to /admin/index.php/datafile/download containing ../, ..%2f, or encoded traversal sequences in the filename parameter.
Web server access logs showing successful 200 responses to download requests targeting unusual file paths such as /etc/passwd, wp-config, or .env.
Unexpected outbound transfer of configuration or credential files originating from the hfly host.

Detection Strategies

Inspect web server and application logs for filename query values that include directory traversal metacharacters or absolute paths.
Deploy WAF rules that flag traversal patterns on admin endpoints, including URL-encoded and double-encoded variants.
Correlate authenticated admin sessions with high-volume or anomalous file download activity.

Monitoring Recommendations

Enable verbose logging on the hfly admin interface and forward logs to a centralized analytics platform.
Alert on any admin account performing repeated datafile/download requests within short intervals.
Monitor filesystem access by the PHP process for reads outside the application's data directory.

How to Mitigate CVE-2025-14521

Immediate Actions Required

Restrict network access to the /admin/ path using IP allow-lists, VPN, or reverse-proxy authentication.
Rotate all administrative credentials and review admin account membership for the hfly deployment.
Audit web server logs for prior exploitation attempts targeting the datafile/download route.
Treat any secrets stored on the host as potentially exposed and rotate them.

Patch Information

The vendor baowzh did not respond to disclosure and operates a rolling release without versioned advisories. No official patch is referenced in the NVD data. Operators should track the upstream repository for commits superseding 638ff9abe9078bc977c132b37acbe1900b63491c that address the datafile/download handler, and apply local hardening until a vendor fix is confirmed.

Workarounds

Add a server-side filter that rejects requests to /admin/index.php/datafile/download containing .., null bytes, or absolute path prefixes.
Run the PHP process under a least-privilege user with open_basedir constrained to the application directory.
Disable the datafile/download route entirely if not required by business operations.
Place the admin interface behind an authenticating reverse proxy that enforces additional access controls.

bash

# Example nginx hardening to block traversal payloads on the affected route
location ~* ^/admin/index\.php/datafile/download {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/|\\x00)") {
        return 403;
    }
    # Restrict to trusted management network
    allow 10.0.0.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}