CVE-2025-15449
Published: 05 January 2026
Summary
CVE-2025-15449 is a medium-severity Path Traversal (CWE-22) vulnerability in Cld378632668 Javamall. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-15449 is a path traversal vulnerability (CWE-22) affecting cld378632668 JavaMall up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The issue resides in the delete function of the file src/main/java/com/macro/mall/controller/MinioController.java, where manipulation of the objectName argument enables traversal outside intended directories.
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation results in low impacts to integrity and availability, with no confidentiality impact, as scored at CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
The product uses continuous delivery with rolling releases, so no specific details on affected or updated versions are available. The vendor was contacted early regarding this disclosure but did not respond. Additional details appear in advisories at the provided references, including VulDB entries and a GitHub disclosure document.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0921
Vulnerability details
A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is…
more
used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in web controller's delete function enables exploitation of public-facing application for arbitrary file deletion.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the objectName input in MinioController.delete to block path traversal sequences like '../', preventing exploitation.
Enforces logical access controls to restrict delete operations to authorized directories only, mitigating path traversal beyond intended storage paths.
Requires timely identification and correction of the path traversal flaw in src/main/java/com/macro/mall/controller/MinioController.java delete function.