CVE-2025-66480: Wildfire IM RCE Vulnerability

CVE-2025-66480 Overview

CVE-2025-66480 is a critical path traversal vulnerability affecting Wildfire IM, an instant messaging and real-time audio/video solution. The vulnerability exists in the im-server component's file upload functionality within com.xiaoleilu.loServer.action.UploadFileAction. The application exposes an endpoint (/fs) that handles multipart file uploads but fails to properly sanitize filenames provided by users, allowing attackers to write arbitrary files to any location on the server's filesystem.

Critical Impact

This path traversal vulnerability enables Remote Code Execution (RCE) by allowing attackers to upload malicious files to arbitrary filesystem locations, potentially overwriting critical system files such as authorized_keys, cron jobs, or uploading web shells.

Affected Products

• Wildfire IM im-server versions prior to 1.4.3
• Applications using the vulnerable UploadFileAction component
• Deployments exposing the /fs file upload endpoint

Discovery Timeline

• February 2, 2026 - CVE-2025-66480 published to NVD
• February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2025-66480

Vulnerability Analysis

The vulnerability resides in the writeFileUploadData method within the UploadFileAction class. When processing file uploads through the /fs endpoint, the application directly concatenates the configured storage directory with the filename extracted from the upload request. This concatenation occurs without any validation or sanitization to prevent directory traversal sequences.

The fundamental security flaw is the absence of input validation on user-controlled filename parameters. When a malicious user submits a file upload request containing traversal sequences such as ../../ in the filename, the application blindly accepts these sequences, allowing the file to be written outside the intended upload directory.

This vulnerability enables attackers to achieve complete server compromise by uploading malicious payloads to strategic locations. An attacker could upload a web shell to the web root directory, inject malicious scripts into cron job directories, overwrite SSH authorized_keys files to gain persistent access, or modify application configuration files to alter system behavior.

Root Cause

The root cause is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The writeFileUploadData method performs unsanitized string concatenation between the storage directory path and the user-supplied filename. The code lacks:

• Validation to reject filenames containing path traversal sequences (../, ..\\)
• Canonicalization of the resulting path to verify it remains within the intended directory
• Whitelist-based filename validation to ensure only safe characters are accepted

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted multipart file upload request to the /fs endpoint. The malicious request would include a filename parameter containing directory traversal sequences designed to place the uploaded file in a sensitive location.

For example, an attacker could craft a filename such as ../../../etc/cron.d/malicious_job or ../../../home/user/.ssh/authorized_keys to write files outside the intended upload directory. The only limitation is the filesystem permissions of the application process—files can be written anywhere the process has write access.

Successful exploitation requires the attacker to have network access to the /fs endpoint and knowledge of the server's filesystem structure to target specific directories effectively.

Detection Methods for CVE-2025-66480

Indicators of Compromise

• Unexpected files appearing in sensitive directories such as /etc/cron.d/, .ssh/, or web root locations
• HTTP POST requests to /fs endpoint containing ../ sequences in multipart form data
• Modified or newly created SSH authorized_keys files with unknown public keys
• Suspicious cron jobs or startup scripts that were not administratively created

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences in file upload parameters
• Monitor file integrity for critical system directories using tools like AIDE or OSSEC
• Analyze HTTP access logs for POST requests to /fs with suspicious filename patterns in multipart data
• Deploy endpoint detection and response (EDR) solutions to identify unauthorized file creation in system directories

Monitoring Recommendations

• Enable verbose logging for the im-server application to capture detailed file upload request information
• Configure file integrity monitoring (FIM) on sensitive directories including /etc/, /var/spool/cron/, and application directories
• Set up alerts for any file creation activity in SSH configuration directories or web server document roots
• Monitor process execution for unexpected child processes spawned from web application contexts

How to Mitigate CVE-2025-66480

Immediate Actions Required

• Upgrade Wildfire IM im-server to version 1.4.3 or later immediately
• If immediate patching is not possible, restrict network access to the /fs endpoint using firewall rules or reverse proxy configurations
• Audit filesystem for any unauthorized files that may have been created through exploitation
• Review and rotate SSH keys if the system may have been compromised

Patch Information

The vulnerability has been fixed in Wildfire IM im-server version 1.4.3. The patch implements proper filename sanitization to strip directory traversal sequences before constructing the file path. Organizations should upgrade to this version as soon as possible.

For detailed information about the fix, refer to the GitHub Security Advisory GHSA-74hq-jhx2-fq6c and the GitHub Commit Changes. The patched release is available at GitHub Release Version 1.4.3.

Workarounds

• Deploy a reverse proxy or WAF in front of the application configured to reject requests containing ../ or ..\\ in any parameter
• Restrict network access to the /fs endpoint to trusted IP addresses only
• Run the im-server process with minimal filesystem permissions to limit the impact of exploitation
• Implement application-level access controls to require authentication for file upload functionality

# Example: Nginx configuration to block path traversal attempts
location /fs {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    
    # Restrict access to trusted networks
    allow 10.0.0.0/8;
    deny all;
    
    proxy_pass http://im-server-backend;
}