CVE-2025-15449

MediumPublic PoC

Published: 05 January 2026

Published

05 January 2026

Modified

08 March 2026

KEV Added

—

Patch

—

CVSS Score 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS Score 0.0021 43.4th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15449 is a medium-severity Path Traversal (CWE-22) vulnerability in Cld378632668 Javamall. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation of the objectName input in MinioController.delete to block path traversal sequences like '../', preventing exploitation.

AC-3 Access Enforcement good match

prevent

Enforces logical access controls to restrict delete operations to authorized directories only, mitigating path traversal beyond intended storage paths.

SI-2 Flaw Remediation good match

prevent

Requires timely identification and correction of the path traversal flaw in src/main/java/com/macro/mall/controller/MinioController.java delete function.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Path traversal in web controller's delete function enables exploitation of public-facing application for arbitrary file deletion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is…

used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2025-15449 is a path traversal vulnerability (CWE-22) affecting cld378632668 JavaMall up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The issue resides in the delete function of the file src/main/java/com/macro/mall/controller/MinioController.java, where manipulation of the objectName argument enables traversal outside intended directories.

A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation results in low impacts to integrity and availability, with no confidentiality impact, as scored at CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

The product uses continuous delivery with rolling releases, so no specific details on affected or updated versions are available. The vendor was contacted early regarding this disclosure but did not respond. Additional details appear in advisories at the provided references, including VulDB entries and a GitHub disclosure document.