CVE-2025-11034

Vulnerability

Analysis

The vulnerability resides in the downloadImpTemplet function within /common/dep/common_dep.action.jsp. The function accepts a filePath parameter and uses it to construct a file path via request.getServletContext().getRealPath(filePath) without proper sanitization. This allows an attacker to supply a path traversal sequence (e.g., ../) to escape the intended directory and access arbitrary files on the server [1].

Exploitation

An unauthenticated attacker can exploit this by sending a crafted HTTP request to the vulnerable endpoint with a malicious filePath parameter. The attack is remotely exploitable and does not require any special privileges. The exploit has been publicly disclosed, increasing the risk of widespread use [1].

Impact

Successful exploitation allows an attacker to read sensitive files from the server, such as configuration files, source code, or credentials. This can lead to further compromise of the system and data exposure.

Mitigation

The vendor has not released a patch as of the publication date. Users should apply input validation on the filePath parameter or restrict access to the vulnerable endpoint until an official fix is available.