CVE-2025-29930: imFAQ Path Traversal Vulnerability

CVE-2025-29930 Overview

CVE-2025-29930 is a Local File Inclusion (LFI) vulnerability in imFAQ, a questions and answers management module for ImpressCMS. The flaw affects all versions prior to 1.0.1. The $_GET['seoOp'] and $_GET['seoArg'] parameters are consumed by the SEO handler without sanitization or validation. Attackers can supply PHP stream wrappers such as php://filter/read=convert.base64-encode/resource=/var/www/html/config.php to read arbitrary files readable by the web server. ImpressCMS partially mitigates the impact by storing sensitive files outside the web root in a folder with a randomized name. The issue is fixed in imFAQ 1.0.1.

Critical Impact
Unauthenticated remote attackers can read local files on the server by manipulating the seoOp request parameter, exposing configuration data and source code.

Affected Products

ImpressModules imFAQ versions prior to 1.0.1
ImpressCMS installations with the imFAQ module enabled
Deployments exposing seo.php to untrusted network traffic

Discovery Timeline

2025-03-18 - CVE-2025-29930 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29930

Vulnerability Analysis

The vulnerability is classified as External Control of File Name or Path [CWE-73], commonly exploited as Local File Inclusion. The seo.php entry point reads the seoOp query parameter and uses it in file handling logic without validating it against an allowlist. Because PHP treats stream wrappers like php://filter as valid path prefixes, an attacker can coerce the application to open and return the contents of files on disk. Base64 filtering makes it straightforward to exfiltrate binary or PHP source content through HTTP responses. The impact is confined to confidentiality; the flaw does not directly enable remote code execution or write access.

Root Cause

The root cause is missing input validation on $_GET['seoOp'] and $_GET['seoArg']. The original code branches on whether seoOp is empty, but never restricts the value to a known set of SEO operations. Any string supplied by the client is trusted and forwarded into path-handling logic downstream.

Attack Vector

Exploitation requires only a crafted HTTP GET request to the seo.php endpoint. No authentication or user interaction is required. An attacker sends a request such as GET /modules/imfaq/seo.php?seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php and receives the base64-encoded contents of the target file in the response body.

php

 include '../../mainfile.php';
 
-if (empty($_GET['seoOp']))
+$seoMap = array(
+    'category' => 'category.php',
+    'faq' => 'faq.php',
+    'print' => 'print.php'
+);
+
+if(array_key_exists($_GET['seoOp'], $seoMap) || $_GET['seoOp'] = '')
+{
+    $safe_seoOp = $_GET['seoOp'];
+};
+
+if (empty($safe_seoOp))
 {
 	// SEO mode is path-info

Source: GitHub commit 63dedd3. The patch introduces $seoMap, an allowlist of valid SEO operations, and only assigns $safe_seoOp when the incoming value matches a known key.

Detection Methods for CVE-2025-29930

Indicators of Compromise

HTTP requests to seo.php containing php://filter, php://input, file://, or data:// in the seoOp or seoArg query parameters
Requests where seoOp contains directory traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f
Web server access logs showing repeated requests to seo.php with unusually long query strings targeting configuration files

Detection Strategies

Deploy web application firewall rules that block PHP stream wrappers appearing in query parameters for the imFAQ endpoints
Alert on outbound response bodies from seo.php that contain base64 blobs matching known configuration or credential file signatures
Correlate requests to seo.php with 200-status responses that return unexpected content types or oversized payloads

Monitoring Recommendations

Monitor read access to sensitive filesystem paths, including /etc/passwd, /var/www/html/, and ImpressCMS configuration directories
Track anomalous PHP process file open activity originating from web server user contexts
Retain full HTTP request and response logs for the imFAQ module to support post-incident forensics

How to Mitigate CVE-2025-29930

Immediate Actions Required

Upgrade imFAQ to version 1.0.1 or later, which applies the $seoMap allowlist patch
Audit web and application logs for requests to seo.php containing stream wrapper syntax or traversal payloads
Rotate any credentials, API keys, or secrets stored in files that may have been exposed by prior exploitation

Patch Information

The fix is committed in 63dedd30a8f196db7b340740adf667a39c26a4ac and published in imFAQ 1.0.1. Details are available in the GitHub Security Advisory GHSA-vrr3-54vc-vwg3.

Workarounds

Restrict access to the imFAQ seo.php endpoint at the reverse proxy or web server layer until the module is upgraded
Disable dangerous PHP stream wrappers by setting allow_url_include=Off and configuring open_basedir to constrain filesystem access
Apply a temporary WAF rule that rejects requests where seoOp contains characters or tokens outside [a-zA-Z]+

bash

# Example php.ini hardening to reduce LFI blast radius
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "show_source,system,shell_exec,passthru,exec,popen,proc_open"