CVE-2025-4530: SSM-ERP Path Traversal Vulnerability

CVE-2025-4530 Overview

CVE-2025-4530 is a path traversal vulnerability in the feng_ha_ha/megagaossm-erp and production_ssm project version 1.0. The flaw resides in the handleFileDownload function of FileController.java within the File Handler component. An attacker can manipulate file path parameters to read files outside the intended download directory. The vulnerability is exploitable over the network and requires low privileges. The exploit has been publicly disclosed, increasing the risk of opportunistic use against exposed instances. This product is distributed under two different names, which broadens the affected footprint.

Critical Impact
Remote authenticated attackers can traverse the file system through the download handler to access arbitrary files readable by the application process.

Affected Products

feng_ha_ha/megagao ssm-erp version 1.0
feng_ha_ha/megagao production_ssm version 1.0
File Handler component (FileController.java, handleFileDownload function)

Discovery Timeline

2025-05-11 - CVE-2025-4530 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4530

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] in the handleFileDownload function of FileController.java. The function accepts a user-supplied file identifier or filename and uses it to construct a file path on the server without adequate normalization or containment checks. Because the application concatenates the input into a path passed to file APIs, traversal sequences such as ../ allow the request to escape the intended download directory.

Successful exploitation grants read access to files reachable by the JVM process running the application. Impact depends on process privileges and file system layout, but commonly targeted assets include configuration files, database credentials, and application source. The ssm-erp and production_ssm distributions share the same codebase, so the same request pattern applies to both.

Root Cause

The root cause is missing canonicalization and allow-list validation of the file path parameter used by handleFileDownload. The controller trusts client-supplied input and does not verify that the resolved path remains within the configured download root.

Attack Vector

An attacker sends an HTTP request to the file download endpoint served by FileController.java, supplying a path parameter containing directory traversal sequences. The request requires network reachability to the application and a low-privileged account. No user interaction is required.

// Example exploitation code (sanitized)
No verified proof-of-concept code is published in the referenced advisories.
See the linked GitHub issue and VulDB entries for technical details:
- https://github.com/Hao-Ni/CVE/issues/2
- https://vuldb.com/?id.308275

Detection Methods for CVE-2025-4530

Indicators of Compromise

HTTP requests to file download endpoints containing ../, ..\, encoded variants such as %2e%2e%2f, or absolute path prefixes.
Application access log entries showing successful downloads referencing files outside the configured upload or storage directory.
Unexpected read access by the application user to system files such as /etc/passwd, application.properties, or database configuration files.

Detection Strategies

Deploy web application firewall rules that inspect query parameters and path segments for traversal patterns and reject requests that resolve outside the intended download root.
Instrument FileController.java invocations to log the canonical resolved path and alert when it falls outside the allowed base directory.
Correlate authentication events with file download requests to identify low-privilege accounts probing multiple file paths.

Monitoring Recommendations

Monitor HTTP 200 responses to the download endpoint that return file content types inconsistent with expected user-uploaded assets.
Track access frequency and volume per authenticated session against the download handler to identify enumeration behavior.
Alert on process-level file reads outside the application working directory when running the ssm-erp or production_ssm service.

How to Mitigate CVE-2025-4530

Immediate Actions Required

Restrict network exposure of the ssm-erp and production_ssm file download endpoint to trusted internal networks or VPN access.
Rotate any credentials, tokens, or keys stored in files readable by the application process, since these may have been exfiltrated.
Review application access logs for suspicious download requests dating back to deployment.

Patch Information

No vendor patch is referenced in the available advisories. Track the GitHub CVE issue and the VulDB entry #308275 for updates from the maintainer.

Workarounds

Add server-side validation in handleFileDownload that canonicalizes the requested path and verifies it starts with the configured download base directory.
Replace user-supplied filenames with server-side identifiers such as UUIDs mapped to stored file records to eliminate direct path input.
Run the application under a least-privileged operating system account with file system access limited to the required storage directory.

bash

# Configuration example
# Example nginx rule to block obvious traversal attempts before reaching the app
location /file/download {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 400;
    }
    proxy_pass http://ssm_backend;
}