CVE-2025-9650 in carRental
Summary
by MITRE • 08/29/2025
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/12/2026
This vulnerability in yeqifu carRental represents a critical path traversal flaw that compromises the application's file system security. The issue manifests within the removeFileByPath function located in src/main/java/com/yeqifu/sys/utils/AppFileUtils.java, where improper input validation allows malicious actors to manipulate the carimg parameter through directory traversal sequences. The vulnerability exists because the application fails to properly sanitize user-supplied file paths before executing file operations, creating an opportunity for attackers to access arbitrary files on the server's file system beyond the intended application boundaries.
The technical exploitation of this vulnerability follows established path traversal attack patterns that map directly to CWE-22 - Improper Limitation of a Pathname to a Restricted Directory. Attackers can leverage this flaw by crafting malicious input containing sequences like ../ or ..\ that navigate outside the intended directory structure, potentially accessing sensitive configuration files, database credentials, or other critical system resources. The remote attack vector significantly amplifies the impact as adversaries need not have physical access to the server to exploit this weakness.
The operational impact of this vulnerability extends beyond simple unauthorized file access, creating potential for complete system compromise and data exfiltration. Given that the product employs a rolling release strategy for continuous delivery, the vulnerability may remain unpatched across multiple versions simultaneously, exposing a broad user base to risk. The public disclosure of exploit details increases the likelihood of automated attacks targeting installations with vulnerable versions, particularly in environments where regular security updates are not consistently applied.
Security mitigation strategies should prioritize immediate implementation of input validation controls that sanitize all file path parameters through comprehensive whitelisting approaches or strict path normalization. Organizations should implement proper access controls and privilege separation to limit the damage potential even if exploitation occurs. The application architecture must be reviewed to eliminate direct file system operations with user-supplied data, instead implementing secure abstraction layers that validate and restrict file operations within defined boundaries. Additionally, regular security assessments and vulnerability scanning should be integrated into the continuous delivery pipeline to identify similar flaws before they can be exploited in production environments. This vulnerability demonstrates the critical importance of input validation and proper access control implementation as outlined in the ATT&CK framework's privilege escalation and defense evasion techniques.