CVE-2025-34045

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34045
A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2020/CNVD-2020-68596.yaml Exploit
https://vulncheck.com/advisories/weiphp-path-traversal-file-read Exploit Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:*
History

23 Sep 2025, 19:27

Type Values Removed Values Added
CPE cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:*
First Time Weiphp
Weiphp weiphp
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2020/CNVD-2020-68596.yaml - () https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2020/CNVD-2020-68596.yaml - Exploit
References () https://vulncheck.com/advisories/weiphp-path-traversal-file-read - () https://vulncheck.com/advisories/weiphp-path-traversal-file-read - Exploit, Third Party Advisory
References () https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596 - () https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596 - Third Party Advisory
Summary
  • (es) Existe una vulnerabilidad de path traversal en WeiPHP 5.0, un framework de desarrollo de código abierto para la plataforma de cuentas públicas de WeChat de Shenzhen Yuanmengyun Technology Co., Ltd. La falla se produce en el parámetro picUrl del endpoint /public/index.php/material/Material/_download_imgage, donde una validación de entrada insuficiente permite a atacantes remotos no autenticados navegar por directorios mediante solicitudes POST manipuladas. Esto permite la lectura arbitraria de archivos en el servidor, lo que podría exponer información confidencial, como archivos de configuración y código fuente.

26 Jun 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-26 16:15

Updated : 2025-09-23 19:27

NVD link : CVE-2025-34045

Mitre link : CVE-2025-34045

CVE.ORG link : CVE-2025-34045

JSON object : View

Products Affected

weiphp

  • weiphp
CWE
CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor