CVE-2025-14522: Baowzh Hfly RCE Vulnerability

CVE-2025-14522 Overview

A vulnerability has been identified in baowzh hfly, a PHP-based travel website CMS, that allows unrestricted file upload through the KindEditor component. The vulnerability exists in the file /Public/Kindeditor/php/upload_json.php, where improper validation of the imgFile argument enables attackers to upload arbitrary files to the server. This can be exploited remotely by authenticated users, potentially leading to cross-site scripting (XSS) attacks or arbitrary code execution on the target system.

Critical Impact

Remote attackers can upload malicious files including PHP scripts or HTML files containing XSS payloads, potentially compromising the web server and affecting users who access the uploaded content.

Affected Products

• baowzh hfly (up to commit 638ff9abe9078bc977c132b37acbe1900b63491c)
• PHP-based travel website CMS with KindEditor integration

Discovery Timeline

• 2025-12-11 - CVE-2025-14522 published to NVD
• 2026-01-09 - Last updated in NVD database

Technical Details for CVE-2025-14522

Vulnerability Analysis

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type, CWE-284: Improper Access Control) affects the file upload functionality within the KindEditor rich text editor component integrated into hfly CMS. The upload_json.php script fails to properly validate or restrict the types of files that can be uploaded via the imgFile parameter.

The vulnerability is accessible over the network and requires low-level authentication to exploit. An attacker can manipulate the imgFile argument to bypass intended file type restrictions, allowing the upload of potentially dangerous files such as PHP scripts, HTML files with embedded JavaScript, or other executable content. The exploit has been made publicly available, increasing the risk of widespread exploitation.

The vendor (baowzh) was contacted regarding this disclosure but did not respond. Additionally, hfly uses a rolling release model, meaning no specific version numbers are available for tracking affected or patched releases.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and file type verification within the upload_json.php script. The KindEditor PHP upload handler does not properly sanitize or validate the uploaded file's content type, extension, or contents before storing it on the server. This allows attackers to bypass client-side restrictions and upload arbitrary file types that should be restricted.

Attack Vector

The attack is executed remotely over the network against the vulnerable file upload endpoint. An authenticated attacker sends a crafted HTTP POST request to /Public/Kindeditor/php/upload_json.php with a malicious file in the imgFile parameter. The file is accepted and stored on the server without proper validation, allowing the attacker to subsequently access the uploaded file to trigger XSS or execute malicious code.

The vulnerability mechanism involves sending a specially crafted multipart form-data request containing a malicious file disguised or submitted through the imgFile parameter. Since the upload handler lacks proper file type verification, files such as PHP shells, HTML files with JavaScript payloads, or other dangerous content can be stored on the server. For detailed technical analysis, refer to the GitHub XSS File Upload PoC and VulDB entry #335860.

Detection Methods for CVE-2025-14522

Indicators of Compromise

• Unexpected files appearing in upload directories, particularly .php, .html, .htm, or other executable file types
• HTTP POST requests to /Public/Kindeditor/php/upload_json.php with unusual file extensions or content types
• Web server logs showing access to newly uploaded files with script or executable extensions
• Suspicious file names or patterns in the KindEditor upload directory

Detection Strategies

• Monitor web server access logs for POST requests to /Public/Kindeditor/php/upload_json.php followed by GET requests to unusual file paths
• Implement file integrity monitoring on upload directories to detect unauthorized file additions
• Use web application firewall (WAF) rules to block requests containing potentially dangerous file extensions in upload parameters
• Deploy endpoint detection solutions like SentinelOne to identify malicious file creation and execution attempts

Monitoring Recommendations

• Configure alerts for new file creation events in KindEditor upload directories
• Implement real-time log analysis to detect patterns consistent with file upload exploitation attempts
• Review authentication logs for accounts making unusual numbers of upload requests
• Monitor for execution of uploaded scripts or access to files with non-image extensions in image upload directories

How to Mitigate CVE-2025-14522

Immediate Actions Required

• Restrict or disable access to /Public/Kindeditor/php/upload_json.php if file upload functionality is not required
• Implement server-side file type validation using allowlists for permitted file extensions and MIME types
• Configure web server to deny execution of uploaded files in upload directories
• Review and remove any suspicious files from the KindEditor upload directory

Patch Information

As of the last update, no official patch has been released by baowzh. The vendor was contacted regarding this vulnerability but did not respond. Since hfly uses a rolling release model, users should monitor the project repository for any security updates. In the absence of an official fix, implementing the workarounds below is critical.

Workarounds

• Configure .htaccess or web server configuration to disable PHP execution in the KindEditor upload directory
• Implement strict file type validation at the application level, checking both extension and MIME type
• Store uploaded files outside the web root and serve them through a secure handler that validates content type
• Consider replacing KindEditor with a more secure rich text editor component

# Apache configuration to prevent PHP execution in upload directory
# Add to .htaccess in /Public/Kindeditor/php/ or equivalent directory
<Directory "/path/to/webroot/Public/Kindeditor/uploads">
    # Disable PHP execution
    php_flag engine off
    
    # Deny access to potentially dangerous files
    <FilesMatch "\.(php|php5|phtml|cgi|pl|py|html|htm|js)$">
        Require all denied
    </FilesMatch>
</Directory>