GitHub Advisoryadvisory · Maven

GHSA-cg6m-9276-qpjj vlife-base has Path Traversal vulnerability

MEDIUM Published 2025-11-17 Modified 2025-11-17 Official page ↗
Aliases
CVE-2025-13266
Ecosystem
Maven
Packages
io.github.wwwlike:vlife-base
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2025-11-17

Affected packages

• Maven io.github.wwwlike:vlife-base: <= 2.0.1 (no fix yet)

Description

A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Related

Alias · CVE (1)

  • CVE-2025-13266 A security vulnerability has been detected in wwwlike vlife up to 2.0.1. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References