A vulnerability marked as critical has been reported in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/datafile/delfile. This manipulation of the argument filename causes path traversal.
This vulnerability is tracked as CVE-2025-14520. The attack is possible to be carried out remotely. Moreover, an exploit is present.
This product adopts a rolling release strategy to maintain continuous delivery
The vendor was contacted early about this disclosure but did not respond in any way.
