CVE-2025-7452: go-chat Path Traversal Vulnerability

CVE-2025-7452 Overview

CVE-2025-7452 is a path traversal vulnerability [CWE-22] in the kone-net go-chat application, an open-source Go-based chat platform. The flaw resides in the GetFile function within go-chat/api/v1/file_controller.go. An attacker can manipulate the fileName argument to read files outside the intended directory. The issue affects versions up to commit f9e58d0afa9bbdb31faf25e7739da330692c4c63. Because the project uses rolling releases, no fixed version identifier is available. The exploit has been publicly disclosed and can be initiated remotely by an authenticated user.

Critical Impact
Remote authenticated attackers can traverse the file system through the fileName parameter to access files outside the intended directory served by the go-chat endpoint.

Affected Products

kone-net go-chat up to commit f9e58d0afa9bbdb31faf25e7739da330692c4c63
Component: Endpoint (go-chat/api/v1/file_controller.go)
Function: GetFile

Discovery Timeline

2025-07-11 - CVE-2025-7452 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7452

Vulnerability Analysis

The vulnerability exists in the GetFile handler defined in go-chat/api/v1/file_controller.go. The handler accepts a client-supplied fileName parameter and uses it to construct a file path served back to the requester. The handler does not sanitize or canonicalize the input before performing file I/O. As a result, sequences such as ../ allow the request to escape the intended file storage directory.

Because the endpoint accepts requests over the network and requires only low-privilege authentication, any legitimate chat user can attempt directory traversal. The attack targets confidentiality, integrity, and availability at limited scope, since retrievable content depends on the process's file system permissions.

Root Cause

The root cause is missing input validation on the fileName request parameter. The handler concatenates user input directly into a file path without rejecting path separators, parent-directory references, or absolute paths. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated attacker sends an HTTP request to the file endpoint with a crafted fileName value containing traversal sequences such as ../../etc/passwd. The server resolves the manipulated path and returns the contents of files accessible to the go-chat process. Exploitation requires no user interaction and can be automated against exposed instances. Public proof-of-concept details are available through the referenced GitHub Issue Detail and VulDB #316096 Analysis.

Detection Methods for CVE-2025-7452

Indicators of Compromise

HTTP requests to the go-chat file endpoint containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes in the fileName parameter.
Access log entries showing successful 200 OK responses to file requests referencing system paths such as /etc/, /proc/, or application configuration directories.
Outbound file transfers from the go-chat process for files outside its designated upload storage directory.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the fileName query and body parameters for path traversal patterns and reject non-alphanumeric filenames.
Enable verbose HTTP access logging on the go-chat service and forward logs to a SIEM for pattern matching against traversal signatures.
Correlate file system audit events (Linux auditd, Windows object access) with go-chat process activity to identify reads outside the expected upload directory.

Monitoring Recommendations

Alert on any file read by the go-chat process outside the configured storage path.
Monitor authentication logs for accounts issuing repeated file download requests with unusual filename patterns.
Track response sizes and content types for the file endpoint to identify anomalous retrievals of configuration or credential files.

How to Mitigate CVE-2025-7452

Immediate Actions Required

Restrict network access to the go-chat file endpoint to trusted networks until a patched build is deployed.
Rebuild the application from the latest upstream commit that addresses the GetFile traversal issue and validate the change in file_controller.go.
Rotate any credentials, tokens, or secrets that may be stored in files reachable by the go-chat process.

Patch Information

The kone-net go-chat project uses a rolling release model, so no fixed version tag is published for CVE-2025-7452. Consult the upstream GitHub Issue Discussion for remediation guidance and merge the corresponding commit that adds input validation to the GetFile handler before redeploying.

Workarounds

Add a reverse proxy rule that rejects requests to the file endpoint containing .., %2e%2e, or backslash sequences in the fileName parameter.
Run the go-chat process under a dedicated low-privilege user whose file system access is restricted to the upload storage directory only.
Apply mandatory access controls (AppArmor, SELinux) to confine the go-chat binary to its intended read paths.

bash

# Example nginx reverse proxy rule to block traversal patterns
location /api/v1/file {
    if ($arg_fileName ~* "(\.\./|\.\.\\|%2e%2e|/etc/|/proc/)") {
        return 403;
    }
    proxy_pass http://go_chat_backend;
}