CVE-2025-1336
📋 TL;DR
This path traversal vulnerability in CmsEasy 7.7.7.9 allows attackers to delete arbitrary files on the server by manipulating the imgname parameter in the deleteimg_action function. Attackers can exploit this remotely without authentication to delete critical system files. Only CmsEasy 7.7.7.9 installations are affected.
💻 Affected Systems
- CmsEasy
📦 What is this software?
Cmseasy by Cmseasy
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files like /etc/passwd, web.config, or application files leading to denial of service and potential privilege escalation.
Likely Case
Deletion of web application files causing website defacement, data loss, or denial of service for the CmsEasy application.
If Mitigated
Limited impact with proper file permission restrictions and web server sandboxing preventing access to critical system files.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to newer CmsEasy version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Patch
allAdd path traversal validation to the deleteimg_action function in lib/admin/image_admin.php
Edit lib/admin/image_admin.php and add validation: if (strpos($imgname, '..') !== false || strpos($imgname, '/') !== false) { die('Invalid filename'); }
File Permission Restriction
linuxRestrict web server user permissions to prevent deletion of files outside web directory
chown -R root:root /var/www/html
chmod -R 755 /var/www/html
setfacl -R -m u:www-data:r-x /
🧯 If You Can't Patch
- Restrict admin panel access to trusted IP addresses only using .htaccess or firewall rules.
- Disable or remove the image_admin.php file if image management functionality is not required.
🔍 How to Verify
Check if Vulnerable:
Check if file lib/admin/image_admin.php exists and contains the deleteimg_action function without proper path validation.Check Version:
Check CmsEasy version in admin panel or look for version.txt file in installation directory.Verify Fix Applied:
Verify that path traversal attempts (using ../ in imgname parameter) are rejected with error messages.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /admin.php?case=image&act=deleteimg_action with ../ sequences in parameters
- File deletion errors in web server logs for paths outside expected image directories
Network Indicators:
- POST/GET requests containing path traversal sequences (.../) to admin endpoints
SIEM Query:
source="web_server" AND (uri="*deleteimg_action*" AND (param="*../*" OR param="*..\\*"))