CVE-2025-65878

High · 7.5

CVSS

7.5

EPSS

0.7%

Published

Dec 5, 2025

CISA due date

—

The record

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information.

Affected packages

Ecosystem	Package	Introduced	Fixed