CVE-2025-7452

Vulnerability

The vulnerability resides in the GetFile function of go-chat/api/v1/file_controller.go in the kone-net/go-chat project (rolling release up to commit f9e58d0afa9). The endpoint accepts a fileName parameter and uses ioutil.ReadFile to read the file without any validation or sanitization. This allows an attacker to supply path traversal sequences (e.g., ../../../../etc/passwd) to read files outside the intended directory [1][2].

Exploitation

The attack is remotely exploitable with no authentication required. By sending a GET request to /file/../../../../etc/passwd, an attacker can read arbitrary files from the server's filesystem. The lack of input validation on the fileName parameter directly enables this directory traversal attack [1][2].

Impact

An attacker can read sensitive files on the server, such as /etc/passwd, configuration files, or any other file readable by the application process. This may lead to disclosure of secrets, credentials, or system information that could facilitate further compromise. The official description and references classify this as a critical issue [1][2].

Mitigation

At the time of publication, no patched release is available; the project uses a rolling release model, and the latest commit at disclosure was f9e58d0afa9. Users should implement input validation or sanitization on the fileName parameter, restrict allowed paths, or apply file access controls as a workaround until a fix is provided [1].