CVE-2025-6774: sublinkX Path Traversal Vulnerability

CVE-2025-6774 Overview

CVE-2025-6774 is a path traversal vulnerability in gooaclok819 sublinkX versions up to 1.8. The flaw resides in the AddTemp function within api/template.go, where the filename argument is not properly sanitized before being used in file operations. Remote attackers with low-level privileges can manipulate the filename parameter to traverse directories and write files outside the intended template directory. The vendor addressed the issue in version 1.9 through commit 778d26aef723daa58df98c8060c43f5bf5d1b10b. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated remote attackers can exploit the filename parameter in AddTemp to write files outside the template directory, potentially affecting integrity and availability of the sublinkX application.

Affected Products

gooaclok819 sublinkX versions up to and including 1.8
api/template.go component containing the AddTemp function
Deployments of sublinkX exposing the template API endpoint remotely

Discovery Timeline

2025-06-27 - CVE-2025-6774 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6774

Vulnerability Analysis

The vulnerability is a classic path traversal flaw in the AddTemp handler of sublinkX, a subscription link conversion tool written in Go. The AddTemp function in api/template.go accepts a filename argument from a remote request and uses it to create or write a template file on disk. Because the handler does not normalize or validate the supplied path, attackers can embed ../ sequences or absolute paths in filename to escape the intended template storage directory.

Exploitation requires network reachability to the API and low privileges to invoke the endpoint. Successful abuse can overwrite arbitrary files writable by the sublinkX process, enabling tampering with configuration files, logs, or binaries loaded at runtime. The public disclosure through VulDB and the GitHub issue tracker increases the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is missing input validation on the filename parameter inside the AddTemp function. The code concatenates the user-controlled value with a base template directory without filtering .. sequences, path separators, or absolute path prefixes. This matches the CWE-22 pattern of improper pathname restriction.

Attack Vector

An authenticated remote attacker sends a crafted request to the template creation endpoint with a filename value such as ../../etc/sublink/config.json. The sublinkX process resolves that path relative to its working directory and writes the attacker-controlled content there, bypassing the directory boundary.

// Patch excerpt from commit 778d26aef723daa58df98c8060c43f5bf5d1b10b (api/auth.go)
// Illustrates the broader 1.9 security release that also fixes AddTemp path traversal.
func GetToken(username string) (string, error) {
    // Expiration days now sourced from config instead of hardcoded 14 days
    ExpireDays := models.ReadConfig().ExpireDays
    c := &middlewares.JwtClaims{
        Username: username,
        StandardClaims: jwt.StandardClaims{
            ExpiresAt: time.Now().Add(time.Hour * 24 * time.Duration(ExpireDays)).Unix(),
            IssuedAt:  time.Now().Unix(),
            Subject:   username,
        },
    }
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, c)
}
// Source: https://github.com/gooaclok819/sublinkX/commit/778d26aef723daa58df98c8060c43f5bf5d1b10b

The path traversal fix itself is applied to api/template.go in the same release. Review the full diff in the GitHub commit and the v1.9 release notes for the sanitization logic.

Detection Methods for CVE-2025-6774

Indicators of Compromise

HTTP requests to the sublinkX template API containing ../, ..\\, URL-encoded %2e%2e%2f, or absolute paths in the filename parameter.
Newly created or modified files outside the configured template directory with timestamps matching sublinkX API activity.
Unexpected changes to sublinkX configuration files, startup scripts, or binaries owned by the service user.

Detection Strategies

Inspect reverse proxy and web server access logs for POST requests to the sublinkX template endpoint carrying traversal sequences in request bodies or query parameters.
Enable file integrity monitoring on directories adjacent to the sublinkX template path to flag writes originating from the sublinkX process.
Correlate authenticated API calls to AddTemp with filesystem write events outside the expected template directory using EDR telemetry.

Monitoring Recommendations

Alert on sublinkX process writes to paths outside its working directory, especially system configuration locations.
Track version banners and build hashes of deployed sublinkX instances to identify unpatched hosts still running 1.8 or earlier.
Monitor the GitHub issue tracker and VulDB entry 314090 for additional exploitation details.

How to Mitigate CVE-2025-6774

Immediate Actions Required

Upgrade sublinkX to version 1.9 or later using the official v1.9 release.
Restrict network access to the sublinkX API so that only trusted administrative networks can reach the template endpoints.
Rotate any API credentials or JWT secrets that may have been exposed through tampered configuration files.

Patch Information

The fix is delivered in commit 778d26aef723daa58df98c8060c43f5bf5d1b10b and shipped in sublinkX 1.9. Operators should pull the tagged release and redeploy. Review the patch commit to verify integration with any local forks.

Workarounds

Place sublinkX behind a reverse proxy that rejects requests containing ../, ..\\, or encoded traversal sequences in the filename parameter.
Run the sublinkX process as an unprivileged user with write access limited to the template directory via filesystem permissions or a mandatory access control profile.
Disable or firewall the template management API if it is not required for operational workflows.

bash

# Example nginx snippet to block traversal attempts in the filename parameter
location /api/template {
    if ($args ~* "filename=.*(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://127.0.0.1:8000;
}