CVE-2025-15432

MediumPublic PoC

Published: 02 January 2026

Published

02 January 2026

Modified

23 February 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0031 54.0th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15432 is a medium-severity Path Traversal (CWE-22) vulnerability in Yeqifu Carrental. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 46.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing web endpoint directly enables remote file read (T1005) via exploitation of the application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. The manipulation of the argument path leads to path traversal. The attack may be initiated…

remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Deeper analysisAI

CVE-2025-15432 is a path traversal vulnerability (CWE-22) discovered in the yeqifu carRental application up to commit 3fabb7eae93d209426638863980301d6f99866b3. It affects the downloadShowFile function within the com.yeqifu.sys.controller.FileController component, exposed at the /file/downloadShowFile.action endpoint. The flaw stems from manipulation of the 'path' argument, allowing directory traversal. The project uses a rolling release model, so specific version details for affected or updated releases are unavailable.

The vulnerability enables remote exploitation by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Attackers can achieve limited confidentiality impact (C:L) by reading arbitrary files outside the intended directory.

VulDB advisories note that the exploit has been publicly disclosed and may be actively used. The project was informed early through GitHub issue #46 but has not responded. No patches or specific mitigations are detailed, consistent with the rolling release approach.