CVE-2025-8753: Linlinjava Litemall Path Traversal Vulnerability

CVE-2025-8753 Overview

CVE-2025-8753 is a path traversal vulnerability [CWE-22] in linlinjava litemall versions up to 1.8.0. The flaw exists in the delete function of the /admin/storage/delete endpoint within the File Handler component. An attacker who manipulates the key argument can traverse the file system outside of the intended storage directory. The attack is remotely exploitable and requires low-level privileges on the administrative interface. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic use against exposed instances.

Critical Impact
Authenticated attackers can delete arbitrary files outside the intended storage directory by manipulating the key parameter, potentially impacting application integrity and availability.

Affected Products

linlinjava litemall versions up to and including 1.8.0
File Handler component (/admin/storage/delete endpoint)
Deployments exposing the litemall admin interface to untrusted networks

Discovery Timeline

2025-08-09 - CVE-2025-8753 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8753

Vulnerability Analysis

The vulnerability resides in the delete function handling requests to /admin/storage/delete in the litemall administrative backend. The endpoint accepts a key parameter that identifies the stored file targeted for deletion. Because the handler does not sufficiently validate or canonicalize this input, attackers can supply traversal sequences such as ../ to escape the storage root. Successful exploitation permits deletion of files outside the intended directory. Impact is bounded to integrity and availability of the file system paths accessible to the litemall process user, with no direct confidentiality compromise from the delete operation itself. Because the operation is destructive rather than read-based, exploitation can disrupt application function, remove log evidence, or delete configuration files. Public disclosure of the technique means detection and patching should be prioritized on any internet-exposed litemall admin surface.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The delete function trusts the client-supplied key value and constructs a file system path without normalizing the input or verifying that the resolved path stays within the designated storage directory.

Attack Vector

An authenticated user with access to the litemall admin API sends a crafted HTTP request to /admin/storage/delete with a key value containing path traversal sequences. The request travels over the network and requires no user interaction. Since the vulnerability is publicly disclosed, adversaries can integrate it into automated scanning against exposed litemall deployments.

No verified proof-of-concept code has been published in the reviewed advisories. Refer to the GitHub Issue #564 for the maintainer discussion of the flaw.

Detection Methods for CVE-2025-8753

Indicators of Compromise

HTTP requests to /admin/storage/delete containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in the key parameter
Unexpected file deletion events on the host running litemall, particularly outside the designated storage directory
Admin session activity from unfamiliar source IP addresses invoking storage management endpoints

Detection Strategies

Deploy web application firewall rules that inspect the key parameter for path traversal patterns on storage endpoints
Correlate application access logs with file system audit logs to identify deletion attempts originating from the litemall process
Alert on repeated 4xx or 5xx responses from /admin/storage/delete that suggest fuzzing or exploitation attempts

Monitoring Recommendations

Enable verbose logging on the litemall admin API and forward logs to a centralized analytics platform for retention and search
Monitor administrative account authentication for anomalous login times, geographies, or user-agent strings
Track file system change events in directories adjacent to the litemall storage root using operating system auditing (auditd, Windows File System Auditing)

How to Mitigate CVE-2025-8753

Immediate Actions Required

Restrict network access to the litemall admin interface using firewall rules, VPN, or IP allowlists
Rotate credentials for all administrative accounts and enforce strong password policies
Review file system integrity in and around the storage directory to confirm no unauthorized deletions have occurred
Audit access logs for prior requests to /admin/storage/delete containing traversal indicators

Patch Information

At the time of writing, no fixed release has been published by the maintainer. Track remediation progress in GitHub Issue #564 Discussion and the VulDB #319250 Overview. Once a patched build is available, upgrade all instances above version 1.8.0 and validate that the delete handler canonicalizes and constrains the key parameter.

Workarounds

Apply reverse proxy rules that reject requests to /admin/storage/delete containing .., encoded traversal sequences, or absolute paths in the key parameter
Run the litemall process under a least-privileged operating system account with write access limited to the intended storage directory
Temporarily disable the storage delete functionality at the reverse proxy if administrative file deletion is not required for operations

bash

# Example NGINX rule to block traversal payloads on the vulnerable endpoint
location = /admin/storage/delete {
    if ($arg_key ~* "(\.\./|\.\.\\|%2e%2e|%252e)") {
        return 403;
    }
    proxy_pass http://litemall_backend;
}