CVE-2025-5029 Overview
CVE-2025-5029 is a path traversal vulnerability [CWE-22] affecting Kingdee Cloud Galaxy Private Cloud BBC System up to version 9.0 Patch April 2025. The flaw resides in the BaseServiceFactory.getFileUploadService.deleteFileAction function within fileUpload/deleteFileAction.jhtml in the File Handler component. Attackers can manipulate the filePath argument to traverse directories outside the intended file boundary. The attack is exploitable remotely and requires low-level authentication privileges. Public disclosure of the exploit has occurred, increasing the likelihood of active exploitation attempts against exposed instances.
Critical Impact
Remote authenticated attackers can delete arbitrary files outside the intended directory scope by supplying crafted filePath values, potentially disrupting application integrity and availability.
Affected Products
- Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0
- Kingdee Cloud Galaxy Private Cloud BBC System 9.0 Patch April 2025
- File Handler component (fileUpload/deleteFileAction.jhtml)
Discovery Timeline
- 2025-05-21 - CVE-2025-5029 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5029
Vulnerability Analysis
The vulnerability exists in the file deletion handler exposed by the Kingdee BBC System web interface. When a request reaches fileUpload/deleteFileAction.jhtml, the deleteFileAction method inside BaseServiceFactory.getFileUploadService receives a user-supplied filePath parameter. The handler passes this value to file system operations without normalizing the path or validating that it stays within an approved base directory.
An attacker with low-privilege access to the application can send crafted requests containing directory traversal sequences such as ../ in the filePath parameter. This allows the attacker to reference files located outside the intended upload directory. Successful exploitation targets integrity and availability of files reachable by the service account running the application.
Root Cause
The root cause is missing canonicalization and path validation on the filePath input. The application trusts client-supplied path strings and resolves them relative to file system operations without enforcing a strict allow-list or verifying the resolved path against a base directory. This is a textbook CWE-22 Improper Limitation of a Pathname to a Restricted Directory condition.
Attack Vector
The attack is delivered over the network against an authenticated session. An attacker submits an HTTP request to the vulnerable deleteFileAction.jhtml endpoint with a manipulated filePath value referencing a location outside the intended file storage directory. The service processes the request under its own permissions, deleting the referenced file. The exploit has been publicly disclosed, increasing the risk of opportunistic scanning and automated exploitation attempts.
See the VulDB entry for CVE-2025-5029 and the Kingdee Knowledge Resource for technical detail.
Detection Methods for CVE-2025-5029
Indicators of Compromise
- HTTP requests to fileUpload/deleteFileAction.jhtml containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path values in the filePath parameter.
- Unexpected file deletions in directories outside the configured upload storage path.
- Web application log entries showing deleteFileAction invocations with unusual filePath values from external or unauthorized users.
Detection Strategies
- Inspect web server and application logs for POST or GET requests to deleteFileAction.jhtml and correlate the filePath parameter against expected upload directory patterns.
- Deploy web application firewall (WAF) rules that identify path traversal sequences in the filePath request parameter targeting the Kingdee BBC endpoint.
- Monitor file system audit events for delete operations initiated by the Kingdee application service account on files outside the designated upload directory.
Monitoring Recommendations
- Enable verbose access logging on the Kingdee BBC application server and forward logs to a centralized analytics platform for pattern analysis.
- Alert on any HTTP 200 response to deleteFileAction.jhtml where the request source is external or the filePath value contains traversal indicators.
- Track baseline file counts and deletion rates within the Kingdee application directory tree to detect anomalous deletion activity.
How to Mitigate CVE-2025-5029
Immediate Actions Required
- Apply the vendor patch referenced in the Kingdee advisory as soon as it is available for your deployment.
- Restrict network access to the Kingdee BBC System management interface using firewall rules or VPN gating to reduce remote exposure.
- Audit application logs for prior invocations of deleteFileAction.jhtml containing traversal patterns and validate the integrity of files in critical directories.
Patch Information
Kingdee has published guidance for this issue. Refer to the Kingdee Knowledge Resource and Kingdee School Detail for remediation instructions and patched builds. Verify installation using vendor-provided validation steps after upgrade.
Workarounds
- Configure a WAF rule to block requests to fileUpload/deleteFileAction.jhtml where the filePath parameter contains ../, ..\, or encoded traversal sequences.
- Enforce least privilege on the operating system account running the Kingdee application to limit the blast radius of arbitrary file deletion.
- Restrict access to the file upload handler to authenticated users with a defined business need, and revoke unnecessary role assignments granting write or delete permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
