CVE-2025-15432 | yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3 com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path path traversal (Issue 46)

A vulnerability was found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. It has been rated as critical. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. The manipulation of the argument path leads to path traversal.

This vulnerability is listed as CVE-2025-15432. The attack may be initiated remotely. In addition, an exploit is available.

This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.

The project was informed of the problem early through an issue report but has not responded yet.