CVE-2025-5544

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5544
A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead01.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.310994 Permissions Required VDB Entry
https://vuldb.com/?id.310994 Third Party Advisory VDB Entry
https://vuldb.com/?submit.585884 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:aaluoxiang:oa_system:-:*:*:*:*:*:*:*
History

15 Oct 2025, 18:08

Type Values Removed Values Added
CPE cpe:2.3:a:aaluoxiang:oa_system:-:*:*:*:*:*:*:*
First Time Aaluoxiang oa System
Aaluoxiang
References () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead01.md - () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead01.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.310994 - () https://vuldb.com/?ctiid.310994 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.310994 - () https://vuldb.com/?id.310994 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.585884 - () https://vuldb.com/?submit.585884 - Third Party Advisory, VDB Entry

04 Jun 2025, 14:54

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en aaluoxiang oa_system hasta 5b445a6227b51cee287bd0c7c33ed94b801a82a5. Se ha clasificado como problemática. Este problema afecta a la imagen de función del archivo src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. La manipulación provoca un path traversal. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. Este producto utiliza un sistema de entrega continua con versiones continuas. Por lo tanto, no se dispone de detalles de las versiones afectadas ni de versiones actualizadas.

03 Jun 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-03 23:15

Updated : 2025-10-15 18:08

NVD link : CVE-2025-5544

Mitre link : CVE-2025-5544

CVE.ORG link : CVE-2025-5544

JSON object : View

Products Affected

aaluoxiang

  • oa_system
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')