{"id":"CVE-2025-6453","aliases":["EUVD-2025-18832","GHSA-pq7r-gxvg-33fh"],"status":"published","title":"diyhi bbs API ForumManageAction.java add path traversal","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00454,"percentile":0.39851,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-06-22T02:31:05Z","modified":"2026-10-28T02:31:06Z","products":[{"vendor":"diyhi","product":"bbs"}],"references":[{"url":"https://vuldb.com/?id.313560","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.313560","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.598862","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md","tags":["exploit","Exploit","evidence"]},{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md#steps-to-reproduce","tags":["exploit","Exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6453","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pq7r-gxvg-33fh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6453.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-6453","title":"diyhi bbs API ForumManageAction.java add path traversal","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-06-22T02:31:05.226Z","modified":"2025-06-23T14:51:03.172Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:40.072186Z"}],"euvd":[{"id":"EUVD-2025-18832","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-06-22T02:31:05Z","modified":"2025-06-23T14:51:03Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:32:18.218874Z"}],"ghsa":[{"id":"GHSA-pq7r-gxvg-33fh","title":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function...","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-06-22T03:30:29Z","modified":"2025-06-22T03:30:35Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:48.223406Z"}],"nvd":[{"id":"CVE-2025-6453","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-06-22T03:15:31.49Z","modified":"2026-06-17T10:01:55.587Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:14.091082Z"}],"osv":[{"id":"CVE-2025-6453","title":"diyhi bbs API ForumManageAction.java add path traversal","description":"A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-06-22T02:31:05.226Z","modified":"2026-10-28T02:31:06.449542012Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:51.851511Z"}]}}