CVE-2025-7108: Risesoft-y9 Digital Infrastructure Path Traversal

CVE-2025-7108 Overview

CVE-2025-7108 is a path traversal vulnerability [CWE-22] in risesoft-y9 Digital-Infrastructure versions up to 9.6.7. The flaw resides in the deleteFile function within Y9FileController.java, part of the filemanager webapp module. Attackers manipulate the fullPath argument to traverse outside the intended directory and delete arbitrary files on the host. The attack is launched remotely over the network and requires low privileges. A public exploit has been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated remote attackers can delete arbitrary files outside the intended filemanager directory, potentially corrupting application data and disrupting service availability.

Affected Products

• risesoft-y9 Digital-Infrastructure versions up to and including 9.6.7
• Component: y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager
• Vulnerable class: net.risesoft.y9public.controller.Y9FileController

Discovery Timeline

• 2025-07-07 - CVE-2025-7108 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7108

Vulnerability Analysis

The vulnerability resides in the deleteFile method of Y9FileController.java in the filemanager module of risesoft-y9 Digital-Infrastructure. The controller accepts a user-supplied fullPath parameter and uses it directly to resolve a file target for deletion. Because the input is not canonicalized or constrained to a safe base directory, an attacker can supply traversal sequences such as ../ to escape the intended storage location. The attack is remotely reachable over the network and requires only low-level authentication to execute.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified under [CWE-22]. The deleteFile handler trusts the fullPath request argument without validating that the resolved path remains within the designated file storage root. No allowlist, canonical path check, or chroot-equivalent enforcement is applied prior to invoking the file deletion operation.

Attack Vector

An authenticated attacker sends an HTTP request to the filemanager endpoint invoking deleteFile with a crafted fullPath value containing directory traversal sequences. The server resolves the path relative to the filesystem root and deletes the targeted file. Successful exploitation can remove configuration files, logs, uploaded content, or other data accessible to the application process. A proof-of-concept has been published in the ShenxiuSec cve-proofs repository.

No verified exploit code is reproduced here. See the VulDB entry #315019 for additional technical details.

Detection Methods for CVE-2025-7108

Indicators of Compromise

• HTTP requests to filemanager endpoints containing fullPath parameters with ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes
• Unexpected file deletions in directories outside the configured filemanager storage root
• Application or OS audit log entries showing file removal operations initiated by the webapp service account targeting system paths

Detection Strategies

• Inspect web server and application logs for requests to the deleteFile handler in Y9FileController and alert on fullPath values containing traversal sequences
• Deploy web application firewall (WAF) rules that normalize and reject path traversal patterns in request parameters bound for the filemanager module
• Correlate HTTP access logs with filesystem change events to identify deletions that fall outside the intended storage directory

Monitoring Recommendations

• Enable filesystem auditing (auditd on Linux, Object Access auditing on Windows) on the webapp installation directory and parent paths
• Forward webapp, WAF, and filesystem audit telemetry to a centralized analytics platform for correlation and retention
• Baseline normal deleteFile invocation patterns and alert on anomalous frequency or paths referencing sensitive system locations

How to Mitigate CVE-2025-7108

Immediate Actions Required

• Restrict network access to the filemanager module to trusted administrative networks only
• Revoke or audit low-privilege accounts that can reach the deleteFile endpoint until a patch is applied
• Deploy WAF signatures that block fullPath parameters containing path traversal sequences in requests to the filemanager controller

Patch Information

At the time of publication, no vendor patch has been released. According to the NVD advisory, the vendor was contacted about the disclosure but did not respond. Organizations running risesoft-y9 Digital-Infrastructure 9.6.7 or earlier should monitor the risesoft-y9 project for upstream fixes and apply compensating controls in the interim.

Workarounds

• Run the webapp under a dedicated low-privilege OS account with filesystem write and delete permissions restricted to the designated storage directory
• Place the filemanager storage path on a dedicated mount or container volume so traversal cannot reach application binaries or system configuration
• Add a reverse proxy rule that validates and canonicalizes the fullPath parameter and rejects requests resolving outside the configured base directory
• Disable the filemanager module entirely if it is not required for production operations

# Example NGINX rule to block path traversal patterns to the filemanager endpoint
location /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/ {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://backend;
}