CVE-2025-15589: MuYuCMS Path Traversal Vulnerability

CVE-2025-15589 Overview

A path traversal vulnerability has been identified in MuYuCMS version 2.7, affecting the delete_dir_file function within the file application/admin/controller/Template.php of the Template Management Page component. By manipulating the temn/tp argument, an attacker can traverse directory paths to access or delete files outside the intended directory structure. This vulnerability can be exploited remotely, and a proof-of-concept exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Critical Impact

Remote attackers with administrative privileges can exploit this path traversal flaw to delete arbitrary files on the server, potentially leading to data loss, service disruption, or further system compromise.

Affected Products

• MuYuCMS version 2.7
• Template Management Page component (application/admin/controller/Template.php)
• delete_dir_file function

Discovery Timeline

• 2026-02-24 - CVE-2025-15589 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2025-15589

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the Template Management Page of MuYuCMS 2.7. The delete_dir_file function in application/admin/controller/Template.php fails to properly validate and sanitize the temn/tp parameter before processing file operations. This allows an authenticated administrator to craft malicious requests containing directory traversal sequences (such as ../) to escape the intended directory and perform unauthorized file deletions.

The vulnerability requires network access and administrative privileges to exploit. While the attack complexity is low, the impact is limited to integrity and availability concerns rather than confidentiality, as the primary risk involves unauthorized file deletion rather than data exfiltration.

Root Cause

The root cause of this vulnerability is improper input validation in the delete_dir_file function. The application fails to sanitize user-supplied input for the temn/tp parameter, allowing directory traversal sequences to bypass intended directory restrictions. Without proper validation, path manipulation characters are processed directly, enabling attackers to reference files outside the designated template directory.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with administrative access to the MuYuCMS Template Management interface. An attacker can manipulate the temn/tp parameter in HTTP requests to include path traversal sequences. Upon processing, the server interprets these sequences and performs file deletion operations on arbitrary paths accessible to the web application.

The exploitation flow involves crafting a malicious request to the Template Management endpoint with a specially crafted path parameter. Technical details and a proof-of-concept are available in the GitHub Gist PoC Repository.

Detection Methods for CVE-2025-15589

Indicators of Compromise

• HTTP requests to the Template Management endpoint containing path traversal sequences such as ../ or ..%2f in the temn or tp parameters
• Web server logs showing unusual file deletion patterns or access to directories outside the template directory
• Unexpected file deletions in system or application directories
• Error logs indicating failed file operations on protected paths

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in parameters
• Configure intrusion detection systems (IDS) to alert on suspicious HTTP requests targeting the Template.php endpoint
• Enable detailed logging for file system operations and monitor for anomalous deletion activities
• Audit administrative access logs for unusual activity patterns on the Template Management interface

Monitoring Recommendations

• Monitor web server access logs for requests to application/admin/controller/Template.php with suspicious parameter values
• Set up file integrity monitoring on critical directories to detect unauthorized modifications or deletions
• Implement alerting for multiple failed file operations that may indicate exploitation attempts
• Review administrative user activity logs regularly for signs of account compromise

How to Mitigate CVE-2025-15589

Immediate Actions Required

• Restrict access to the Template Management interface to only trusted administrators
• Implement network-level access controls to limit administrative endpoint exposure
• Consider temporarily disabling the Template Management feature if not essential for operations
• Review web server and application logs for signs of exploitation

Patch Information

No vendor patch is currently available. The vendor was contacted regarding this vulnerability but did not respond. Users should monitor VulDB #336710 for updates on any future patches or vendor advisories.

Workarounds

• Implement input validation at the web server or reverse proxy level to filter path traversal sequences
• Use a web application firewall (WAF) to block requests containing ../ or encoded variants in parameters
• Restrict file system permissions for the web application user to limit the scope of potential damage
• Consider implementing custom code modifications to sanitize the temn/tp parameter before processing

# Example WAF rule to block path traversal attempts (ModSecurity)
SecRule ARGS "@contains ../" \
    "id:1001,phase:2,deny,status:403,msg:'Path Traversal Attempt Blocked'"