CVE-2025-15432 Overview
A path traversal vulnerability has been discovered in yeqifu carRental, a car rental management application. This vulnerability affects the downloadShowFile function within the FileController component (com.yeqifu.sys.controller.FileController). The flaw exists in the handling of the path parameter in the /file/downloadShowFile.action endpoint, allowing attackers to manipulate file paths to access files outside the intended directory structure.
Critical Impact
Remote attackers can exploit this vulnerability to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, and application data without requiring authentication.
Affected Products
- yeqifu carRental (all versions up to commit 3fabb7eae93d209426638863980301d6f99866b3)
Discovery Timeline
- 2026-01-02 - CVE CVE-2025-15432 published to NVD
- 2026-02-23 - Last updated in NVD database
Technical Details for CVE-2025-15432
Vulnerability Analysis
This path traversal vulnerability (CWE-22) resides in the file download functionality of the yeqifu carRental application. The downloadShowFile function in FileController accepts a user-supplied path parameter that is not properly sanitized before being used to access files on the server. This allows attackers to use directory traversal sequences (such as ../) to escape the intended file directory and access arbitrary files on the underlying system.
The vulnerability is accessible via the network without authentication, making it particularly dangerous in internet-facing deployments. While the confidentiality impact is limited to file disclosure without direct system compromise, attackers could potentially retrieve sensitive information including database credentials, configuration files, or user data stored on the server.
The exploit has been publicly disclosed through a GitHub Issue Discussion, increasing the risk of active exploitation. The project maintainer was notified through an issue report but has not yet responded.
Root Cause
The root cause of this vulnerability is insufficient input validation and sanitization of the path parameter in the downloadShowFile.action endpoint. The application fails to properly validate that the requested file path remains within the designated file storage directory, allowing path traversal sequences to be processed and resolved to locations outside the intended scope.
Attack Vector
The attack is conducted remotely over the network by sending a crafted HTTP request to the /file/downloadShowFile.action endpoint. An attacker manipulates the path parameter by including directory traversal sequences (e.g., ../../../etc/passwd on Linux systems or ..\..\..\windows\system32\config\sam on Windows) to navigate to and retrieve sensitive files from the server's file system. No user interaction or authentication is required to exploit this vulnerability.
Detection Methods for CVE-2025-15432
Indicators of Compromise
- HTTP requests to /file/downloadShowFile.action containing path traversal sequences such as ../, ..%2f, ..%252f, or URL-encoded variants
- Unusual file access patterns in web server logs, particularly requests attempting to access system files like /etc/passwd, configuration files, or files outside the application directory
- Multiple requests from the same source probing different directory depths with traversal sequences
Detection Strategies
- Implement web application firewall (WAF) rules to detect and block requests containing directory traversal patterns in URL parameters
- Configure intrusion detection systems (IDS) to alert on path traversal attack signatures targeting the downloadShowFile.action endpoint
- Enable detailed logging for the carRental application and monitor for file access attempts outside the designated upload directory
Monitoring Recommendations
- Monitor web server access logs for requests to /file/downloadShowFile.action with suspicious path parameter values
- Set up alerts for repeated 404 or 500 errors from file access endpoints that may indicate traversal attempts
- Review application logs for file read operations that reference paths outside the expected file storage directory
How to Mitigate CVE-2025-15432
Immediate Actions Required
- Restrict network access to the carRental application to trusted networks only until a patch is available
- Implement WAF rules to block requests containing path traversal sequences (../, ..%2f, etc.) targeting the /file/downloadShowFile.action endpoint
- Consider disabling the file download functionality if not critical to operations
Patch Information
No official patch is currently available from the vendor. The yeqifu carRental project uses a rolling release model without versioned releases, making it difficult to identify specific patched versions. The project maintainer has been notified through a GitHub issue but has not responded. Organizations using this software should monitor the GitHub repository for updates and consider implementing manual code fixes or using alternative software.
Workarounds
- Deploy a reverse proxy or WAF in front of the application to filter and block requests containing directory traversal patterns
- Modify the application code to implement proper input validation by canonicalizing file paths and verifying they remain within the allowed directory before processing
- Apply file system permissions to restrict the web application user's access to only the necessary directories, limiting the impact of successful exploitation
- If possible, disable or remove the /file/downloadShowFile.action endpoint until a proper fix can be implemented
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
