CVE-2025-10273

A path traversal vulnerability exists in the file.aspx endpoint of erjinzhi 10OA version 1.0. The root cause is insufficient validation and sanitization of the 'File' query parameter, allowing directory traversal sequences like ../ to be processed without restriction [1].

The vulnerability can be exploited by sending a crafted GET request to /view/file.aspx with a malicious File parameter. No authentication is required, making the attack accessible to any remote attacker. An example payload includes ../../../../../../../../../../../../../../windows/win.ini to read the Windows system configuration file [1].

Successful exploitation allows an attacker to read arbitrary files on the server, including sensitive configuration files, credentials, and log data. This could lead to further compromise if combined with other vulnerabilities, as the attacker gains insight into the system's internal structure [1].

As of the disclosure date, the vendor has not responded to the report, and no patch is available. Users should consider mitigating controls such as web application firewall rules to block path traversal patterns [1].