CVE-2025-13435

Vulnerability

A path traversal vulnerability exists in the Dreampie Resty framework's HttpClient module, specifically in the Request function of /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java. The filename argument is not sanitized, enabling an attacker to control the file path when writing HTTP response bodies to disk [2][3].

Exploitation

Exploitation requires the attacker to control the HTTP server the client connects to, perform a Man-in-the-Middle attack, or have the application use a user-configurable download source [2]. The attack is remote, highly complex, and does not require authentication [3].

Impact

Successful exploitation allows arbitrary file write, which can lead to code execution (e.g., deploying webshells), privilege escalation, or denial of service [2].

Mitigation

As of November 2025, no patch is available from the vendor, who did not respond to disclosure [2][3]. Users should consider limiting HttpClient usage to trusted sources or implementing additional input validation.