CVE-2025-1743: Pichome Path Traversal Vulnerability

CVE-2025-1743 Overview

CVE-2025-1743 is a path traversal vulnerability in zyx0814 Pichome version 2.1.0. The flaw resides in the /index.php?mod=textviewer endpoint, where the src parameter is not properly sanitized. Attackers can manipulate the src argument to traverse directories and access files outside the intended web root. The vulnerability is remotely exploitable without authentication or user interaction, and a public exploit disclosure exists. The weakness is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the web server process by manipulating the src parameter in the textviewer module.

Affected Products

zyx0814 Pichome 2.1.0

Discovery Timeline

2025-02-27 - CVE-2025-1743 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1743

Vulnerability Analysis

The vulnerability affects the textviewer module in Pichome 2.1.0. When a request is made to /index.php?mod=textviewer, the application accepts a src parameter that specifies the file to be rendered. The application fails to validate or canonicalize this parameter before using it in file read operations. As a result, attackers can supply directory traversal sequences such as ../ to escape the intended directory and read arbitrary files on the underlying filesystem.

The attack is remotely exploitable over the network and requires no authentication or user interaction. Public disclosure of the exploit has occurred through the GitHub Issue on CVE and VulDB #297831 Details. The EPSS score is 1.61% with a percentile of 73.28, indicating moderate probability of exploitation activity relative to other published CVEs.

Root Cause

The root cause is missing input validation on the src parameter within the textviewer module handler. The application concatenates user-controlled input into a file path without applying an allowlist, normalizing path separators, or restricting resolved paths to a base directory. This aligns with [CWE-22], where an attacker can influence file path resolution to reach unintended locations.

Attack Vector

An unauthenticated attacker sends an HTTP request to the vulnerable endpoint with a crafted src value containing traversal sequences. For example, a request targeting /index.php?mod=textviewer&src=../../../../etc/passwd would attempt to read sensitive system files if the web server has appropriate read permissions. Because the interface is web-facing and no credentials are required, exploitation can be automated at scale.

No verified proof-of-concept code is included here. Refer to the GitHub Issue on CVE for technical details.

Detection Methods for CVE-2025-1743

Indicators of Compromise

HTTP requests to /index.php?mod=textviewer containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in the src parameter
Web server access logs showing successful 200 responses to textviewer requests referencing files outside the application directory
Unusual src parameter values referencing system files such as /etc/passwd, boot.ini, or application configuration files

Detection Strategies

Deploy web application firewall (WAF) rules to inspect src parameter values for path traversal payloads on requests targeting the textviewer module
Perform log analysis for repeated requests to /index.php?mod=textviewer from single source IPs within short timeframes, indicating automated probing
Correlate outbound anomalies with file read operations initiated by the PHP process against paths outside the Pichome installation directory

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting Pichome and forward logs to a centralized SIEM for parameter-level inspection
Monitor filesystem access telemetry from the web server user account for reads of sensitive files unrelated to Pichome content
Alert on any file access outside the designated Pichome document root by the PHP interpreter process

How to Mitigate CVE-2025-1743

Immediate Actions Required

Restrict network access to Pichome 2.1.0 instances until a patched version is available, limiting exposure to trusted networks only
Deploy WAF signatures that block requests to /index.php?mod=textviewer containing traversal patterns in the src parameter
Audit web server logs for prior exploitation attempts and evaluate whether sensitive files may have been disclosed

Patch Information

No vendor patch is referenced in the available advisory data. Track the VulDB #297831 Details entry and the upstream project for remediation updates. If no fix is forthcoming, evaluate migration to an alternative image gallery application.

Workarounds

Disable the textviewer module in the Pichome configuration if it is not required for operational use
Enforce filesystem-level restrictions using operating system permissions so that the web server user cannot read files outside the Pichome directory
Run the web server inside a container or chroot jail to constrain the filesystem view available to the application

bash

# Example WAF/ModSecurity rule blocking traversal in the src parameter
SecRule ARGS:src "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1000743,phase:2,deny,status:403,\
    msg:'CVE-2025-1743 Pichome textviewer path traversal attempt'"