CVE-2025-2193 Overview
CVE-2025-2193 is a path traversal vulnerability in MRCMS 3.1.2, a Java-based content management system. The flaw resides in the delete function of the /admin/file/delete.do endpoint, implemented by the org.marker.mushroom.controller.FileController component. Attackers can manipulate the path and name arguments to traverse the file system and delete files outside the intended directory. The vulnerability is exploitable remotely and requires only low-privileged authentication. The exploit details have been disclosed publicly, and the vendor did not respond to disclosure attempts. This issue is tracked under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Authenticated remote attackers can delete arbitrary files on the MRCMS server through path traversal in the file management endpoint, leading to data loss and potential application disruption.
Affected Products
- MRCMS 3.1.2
- org.marker.mushroom.controller.FileController component
- Deployments exposing /admin/file/delete.do to authenticated users
Discovery Timeline
- 2025-03-11 - CVE-2025-2193 published to NVD
- 2025-04-09 - Last updated in NVD database
Technical Details for CVE-2025-2193
Vulnerability Analysis
The vulnerability stems from missing input validation in the file deletion handler of MRCMS. The delete method in FileController accepts user-supplied path and name parameters and concatenates them to construct a target file path. The application does not normalize the resulting path or restrict it to a designated working directory. As a result, an authenticated user can submit traversal sequences such as ../ to reference files outside the intended file management scope. The endpoint is accessible over the network with low attack complexity, and exploitation requires no user interaction.
Root Cause
The root cause is improper sanitization of pathname inputs before they are passed to file system delete operations. Standard mitigations such as canonicalizing the path with File.getCanonicalPath() and verifying the result against an allow-listed base directory are absent. Because the controller trusts client-supplied path segments, the file system reference can escape the intended directory.
Attack Vector
An attacker with valid administrative or low-privilege session credentials sends a crafted HTTP request to /admin/file/delete.do containing traversal sequences in the path or name parameters. The server resolves the manipulated path and performs the delete operation against any file the application user has permission to remove. The exploit details have been published, increasing the likelihood of opportunistic abuse.
No verified public proof-of-concept code is included in the NVD data. Refer to the GitHub Issue Report and VulDB entry #299218 for additional technical context.
Detection Methods for CVE-2025-2193
Indicators of Compromise
- HTTP requests to /admin/file/delete.do containing .., ..%2F, or %2e%2e sequences in the path or name parameters.
- Unexpected deletion of files outside the MRCMS upload directory tree.
- Application logs showing file delete operations referencing absolute paths or parent directories.
Detection Strategies
- Inspect web server and application logs for POST or GET requests to /admin/file/delete.do with suspicious path parameter values.
- Deploy WAF rules that flag traversal patterns in parameters targeting MRCMS administrative endpoints.
- Correlate authenticated session activity with file system delete events on the host running MRCMS.
Monitoring Recommendations
- Enable file integrity monitoring on the MRCMS installation directory and adjacent system paths.
- Alert on bursts of delete operations originating from the Java application user account.
- Audit administrative account usage and revoke unused credentials with access to the file management interface.
How to Mitigate CVE-2025-2193
Immediate Actions Required
- Restrict network access to the /admin/ path of MRCMS to trusted management networks or VPN users only.
- Rotate administrative credentials and review account permissions on affected MRCMS deployments.
- Back up the MRCMS web root and database to support recovery if exploitation occurs.
Patch Information
No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations running MRCMS 3.1.2 should consider migrating to an alternative CMS or applying source-level fixes that canonicalize the file path and validate it against an allow-listed base directory before performing delete operations.
Workarounds
- Place MRCMS behind a reverse proxy or WAF that blocks path traversal sequences in request parameters.
- Run the MRCMS application under a low-privilege OS account with minimal file system permissions outside the web root.
- Disable or remove the file deletion endpoint if it is not required for business operations.
- Implement filesystem-level access controls that prevent the application user from deleting files outside its designated directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
