CVE-2025-2193
Published: 11 March 2025
Summary
CVE-2025-2193 is a medium-severity Path Traversal (CWE-22) vulnerability in Mrcms Mrcms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 45.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2193 is a path traversal vulnerability (CWE-22) classified as critical in MRCMS version 3.1.2. It affects the delete function in the file /admin/file/delete.do within the component org.marker.mushroom.controller.FileController, where manipulation of the path/name argument enables the issue.
The vulnerability allows remote exploitation by low-privileged users (PR:L) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful attacks result in low integrity (I:L) and availability (A:L) impacts but no confidentiality loss (C:N), yielding a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Advisories from VulDB indicate the vendor was contacted early about the disclosure but provided no response, with no patches mentioned. The exploit has been publicly disclosed via a GitHub issue and may be in use.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7535
Vulnerability details
A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/name leads to path traversal. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated path traversal in public-facing web app delete endpoint enables exploitation of public-facing application (T1190), exploitation for privilege escalation (T1068 via vertical escalation to admin file delete), and arbitrary file deletion (T1070.004 for indicator removal or impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the manipulated path/name argument in the FileController delete function to block path traversal sequences like '../'.
Mandates identification, reporting, and correction of the critical path traversal flaw in MRCMS 3.1.2, including application of patches or mitigations despite vendor non-response.
Enforces boundary protection at web interfaces to inspect and deny requests to /admin/file/delete.do containing path traversal payloads.