CVE-2025-11631
📋 TL;DR
This CVE describes a path traversal vulnerability in RainyGao DocSys up to version 2.02.36. Attackers can remotely manipulate the 'path' parameter in the /Doc/deleteDoc.do endpoint to delete arbitrary files on the server. Organizations running vulnerable versions of DocSys are affected.
💻 Affected Systems
- RainyGao DocSys
📦 What is this software?
Docsys by Docsys Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or operating system instability.
Likely Case
Unauthorized deletion of application files, configuration files, or user documents, causing service disruption and data loss.
If Mitigated
Limited impact with proper file permissions and access controls preventing deletion of critical system files.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to any version above 2.02.36 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to block path traversal sequences in the 'path' parameter
Implement server-side validation to reject paths containing '../', '..\', or absolute paths
Web Application Firewall Rule
allBlock requests to /Doc/deleteDoc.do containing path traversal patterns
WAF rule: Block requests where path parameter contains '../', '..\', or absolute path patterns
🧯 If You Can't Patch
- Restrict network access to DocSys instances using firewall rules
- Implement strict file system permissions to limit what files the DocSys process can delete
🔍 How to Verify
Check if Vulnerable:
Check if DocSys version is 2.02.36 or earlier and test if /Doc/deleteDoc.do endpoint accepts path traversal sequencesCheck Version:
Check application version in admin interface or configuration filesVerify Fix Applied:
Test that path traversal attempts to /Doc/deleteDoc.do are properly rejected📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /Doc/deleteDoc.do with unusual path parameters
- File deletion events in system logs from DocSys process
Network Indicators:
- HTTP POST requests to /Doc/deleteDoc.do with path traversal sequences in parameters
SIEM Query:
source="webserver" AND uri_path="/Doc/deleteDoc.do" AND (param_path CONTAINS "../" OR param_path CONTAINS "..\\")🔗 References
- https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md
- https://vuldb.com/?ctiid.328043
- https://vuldb.com/?id.328043
- https://vuldb.com/?submit.664848
- https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md
