CVE-2025-29865: X-Free Uploader Path Traversal Flaw

CVE-2025-29865 Overview

CVE-2025-29865 is a path traversal vulnerability in TAGFREE X-Free Uploader (XFU), a file upload component widely deployed in Korean web applications. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. Attackers can craft requests containing directory traversal sequences to read files outside the intended upload directory. The vulnerability affects X-Free Uploader versions from 1.0.1.0084 before 1.0.1.0085 and from 2.0.1.0034 before 2.0.1.0035. Exploitation requires no authentication and no user interaction, and the attack is delivered remotely over the network.

Critical Impact

Unauthenticated remote attackers can traverse the filesystem to access sensitive files outside the upload directory, exposing configuration data, credentials, and application source code.

Affected Products

• TAGFREE X-Free Uploader (XFU) 1.0.1.0084 and earlier in the 1.x branch
• TAGFREE X-Free Uploader (XFU) 2.0.1.0034 and earlier in the 2.x branch
• Web applications embedding the XFU upload component

Discovery Timeline

• 2025-08-07 - CVE-2025-29865 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-29865

Vulnerability Analysis

The vulnerability resides in the file handling logic of the X-Free Uploader component. The uploader accepts user-controlled path or filename parameters without normalizing or validating them against a restricted base directory. An attacker submitting traversal sequences such as ../ can escape the intended upload directory and reference arbitrary locations on the host filesystem.

The vulnerability impacts confidentiality only — the CVSS vector indicates high confidentiality impact with no integrity or availability impact. This pattern is consistent with an arbitrary file read primitive rather than arbitrary file write or code execution. The EPSS score of 0.167% reflects a low predicted exploitation probability at this time, but the lack of authentication requirements makes the issue accessible to opportunistic scanning.

Root Cause

The root cause is missing canonicalization and validation of pathname inputs supplied through HTTP request parameters. The XFU component constructs file paths by concatenating user input with a base directory rather than resolving the canonical path and verifying it remains within the permitted root. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) directly characterizes this class of weakness.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker sends a crafted HTTP request to an endpoint served by the X-Free Uploader handler, embedding traversal sequences in the parameter that designates the target file or directory. The uploader resolves the manipulated path and returns or processes the file referenced outside the upload root.

No verified public exploit code is available at the time of writing. Refer to the Boho Security Announcement for the official advisory and patched build details.

Detection Methods for CVE-2025-29865

Indicators of Compromise

• HTTP requests to XFU endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in filename or path parameters
• Web server access logs showing requests targeting XFU handler URLs with unusual file extensions outside the upload directory
• Application logs recording file read operations referencing paths such as /etc/passwd, web.config, or application configuration files
• Outbound exfiltration of files immediately following requests to the uploader endpoint

Detection Strategies

• Deploy web application firewall rules that decode and inspect upload parameters for traversal sequences before normalization
• Correlate uploader endpoint access with subsequent unusual file-read patterns at the operating system level
• Inventory all web applications to identify deployments of TAGFREE X-Free Uploader and confirm installed versions against 1.0.1.0085 or 2.0.1.0035

Monitoring Recommendations

• Enable verbose logging on the XFU component to capture full request parameters and resolved file paths
• Forward web server and application logs to a centralized analytics platform for retroactive hunting on traversal patterns
• Alert on access to sensitive system files from the web application service account

How to Mitigate CVE-2025-29865

Immediate Actions Required

• Upgrade X-Free Uploader to version 1.0.1.0085 or 2.0.1.0035 or later, matching the appropriate branch
• Identify all web applications embedding the XFU component and confirm patch deployment across each instance
• Review web server and application logs for traversal patterns dating back to before the patch was applied

Patch Information

TAGFREE has released patched builds 1.0.1.0085 and 2.0.1.0035 that address the path traversal flaw. Patch details and download guidance are documented in the Boho Security Announcement published by the Korea Internet & Security Agency.

Workarounds

• Place a web application firewall in front of the uploader and block requests containing traversal sequences or encoded variants
• Restrict filesystem permissions on the web application service account so it cannot read sensitive files outside the upload directory
• Disable or remove the X-Free Uploader component on applications that do not require file upload functionality until the patch is applied

# Example WAF rule snippet for blocking traversal in upload parameters
# Adjust endpoint path and parameter names to match your deployment
SecRule REQUEST_URI "@contains /xfu/" \
  "id:1029865,phase:2,deny,status:403,\
   chain,msg:'CVE-2025-29865 XFU path traversal attempt'"
  SecRule ARGS|REQUEST_HEADERS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "t:lowercase,t:urlDecodeUni"