CVE-2025-15432
Published: 02 January 2026
Summary
CVE-2025-15432 is a medium-severity Path Traversal (CWE-22) vulnerability in Yeqifu Carrental. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-15432 is a path traversal vulnerability (CWE-22) discovered in the yeqifu carRental application up to commit 3fabb7eae93d209426638863980301d6f99866b3. It affects the downloadShowFile function within the com.yeqifu.sys.controller.FileController component, exposed at the /file/downloadShowFile.action endpoint. The flaw stems from manipulation of the 'path' argument, allowing directory traversal. The project uses a rolling release model, so specific version details for affected or updated releases are unavailable.
The vulnerability enables remote exploitation by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Attackers can achieve limited confidentiality impact (C:L) by reading arbitrary files outside the intended directory.
VulDB advisories note that the exploit has been publicly disclosed and may be actively used. The project was informed early through GitHub issue #46 but has not responded. No patches or specific mitigations are detailed, consistent with the rolling release approach.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0701
Vulnerability details
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. The manipulation of the argument path leads to path traversal. The attack may be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing web endpoint directly enables remote file read (T1005) via exploitation of the application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'path' argument in downloadShowFile.action to reject traversal sequences before arbitrary file reads occur.
Enforces access-control policy on the underlying files so that even a successful traversal cannot read resources outside the application's authorized scope.
Monitors file-system or web-server access patterns for anomalous ../ sequences or reads outside the intended directory, enabling detection of attempted exploitation of this endpoint.