CVE-2025-34045

HIGHNuclei

WeiPHP Path Traversal Arbitrary File Read

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-34045 has a selected CVSS score of 8.7 (high); EIP currently links 1 Nuclei template.

Description

A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 26, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 27, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WeiPHP

Browse Shenzhen Yuanmengyun Technology Co., Ltd / WeiPHP

Default status: unaffected

VulnCheck, CVE List5.0affected

Nuclei templates

1
ProjectDiscoveryHIGHWeiPHP 5.0 - Path TraversalCVSS 8.6

WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.

Impact

Unauthenticated attackers can read arbitrary files including database configuration files through path traversal in the picUrl parameter, potentially exposing sensitive credentials.

Remediation

Upgrade to WeiPHP version 5.1 or later that properly validates file paths in the Material API.

WeaknessesCWE-22
Authorspikpikcu
Template tagscvecve2025weiphplfivulnvkev
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html https://vulncheck.com/advisories/weiphp-path-traversal-file-read

Source: ProjectDiscovery

References

4