CVE-2025-6731

The vulnerability resides in the uploadApk function of SysOssController.java (line 83). The code creates a temporary file using the filename supplied by the user without proper validation, enabling path traversal via the File parameter. [1][2]

Attackers can exploit this by sending a crafted request with a path traversal sequence (e.g., ../) in the filename to the /sys/oss/upload/apk endpoint. No authentication is required to invoke the API, allowing any remote attacker to target arbitrary .apk files on the server. [1]

Successful exploitation results in the deletion of any .apk file on the system, which can lead to denial of service or application compromise. The vendor did not respond to the disclosure, leaving the vulnerability unpatched. [1][2]

As of this report, no official patch or mitigation has been provided by the vendor. Users should restrict network access to the affected endpoint or disable the APK upload functionality if not essential.