CVE-2025-15589
📋 TL;DR
This CVE describes a path traversal vulnerability in MuYuCMS 2.7's Template Management Page. Attackers can remotely exploit the delete_dir_file function to delete arbitrary files on the server. All MuYuCMS 2.7 installations with the vulnerable component are affected.
💻 Affected Systems
- MuYuCMS
📦 What is this software?
Muyucms by Muyucms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or privilege escalation.
Likely Case
Website defacement, data deletion, or service disruption by deleting web application files.
If Mitigated
Limited impact if proper file permissions and web server sandboxing are implemented.
🎯 Exploit Status
Exploit requires authentication to the admin interface. Public PoC available at the provided GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or apply workarounds.
🔧 Temporary Workarounds
Input Validation Sanitization
allAdd input validation to the delete_dir_file function to prevent path traversal.
Edit application/admin/controller/Template.php to sanitize the 'temn/tp' parameter before processing.
Access Restriction
allRestrict access to the Template Management Page to trusted IP addresses only.
Configure web server (e.g., Apache .htaccess or Nginx location block) to allow only specific IPs to /admin/controller/Template.php
🧯 If You Can't Patch
- Disable or remove the Template Management Page if not in use.
- Implement strict file permissions and use a web server sandbox to limit file deletion scope.
🔍 How to Verify
Check if Vulnerable:
Check if MuYuCMS version is 2.7 and the file application/admin/controller/Template.php exists with the vulnerable delete_dir_file function.Check Version:
Check the MuYuCMS configuration or version file, typically in the root directory.Verify Fix Applied:
Test the Template Management Page with path traversal payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion logs in web server or application logs, especially involving path traversal patterns (e.g., '../').
Network Indicators:
- HTTP requests to /admin/controller/Template.php with parameters containing path traversal sequences.
SIEM Query:
source="web_logs" AND uri="/admin/controller/Template.php" AND (param="../" OR param="..\\")