CVE-2025-10766
📋 TL;DR
This CVE describes a path traversal vulnerability in SeriaWei ZKEACMS up to version 4.3. Attackers can manipulate the ID parameter in the Download function to access arbitrary files on the server. Organizations using vulnerable versions of ZKEACMS are affected.
💻 Affected Systems
- SeriaWei ZKEACMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through sensitive file disclosure (e.g., configuration files, credentials, source code) leading to data theft or further exploitation.
Likely Case
Unauthorized access to sensitive files containing configuration data, user information, or system files, potentially enabling lateral movement.
If Mitigated
Limited impact with proper file system permissions and input validation, restricting access to non-critical files only.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The attack requires manipulating the ID parameter to traverse directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version above 4.3 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject directory traversal sequences in the ID parameter
Add validation in EventViewerController.cs to sanitize ID parameter before processing
Web Application Firewall Rule
allBlock requests containing directory traversal patterns
WAF rule to block patterns like ../, ..\, %2e%2e%2f
🧯 If You Can't Patch
- Restrict file system permissions to limit accessible directories
- Implement network segmentation to isolate ZKEACMS from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check ZKEACMS version. If version ≤ 4.3, test by attempting to access files using path traversal in the Download endpoint.Check Version:
Check web.config or application settings for ZKEACMS version informationVerify Fix Applied:
Test that directory traversal attempts are blocked or properly sanitized in the Download function.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests with ../ or similar traversal sequences in URL parameters
Network Indicators:
- HTTP requests to Download endpoint with suspicious ID parameters containing path traversal sequences
SIEM Query:
source="web_logs" AND (url="*Download*" AND (param="*../*" OR param="*..\\*" OR param="*%2e%2e%2f*"))