CVE-2025-34045 is a high-severity path traversal vulnerability identified in WeiPHP version 5.0, an open-source development framework for WeChat public account platforms created by Shenzhen Yuanmengyun Technology Co., Ltd. The vulnerability resides in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint. Due to insufficient input validation, unauthenticated remote attackers can craft POST requests that manipulate the picUrl parameter to perform directory traversal attacks. This allows attackers to read arbitrary files on the server, bypassing intended access restrictions. The potential impact includes exposure of sensitive files such as configuration files, source code, and other critical data stored on the server. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-200 (Information Exposure), and CWE-20 (Improper Input Validation). The CVSS v4.0 base score is 8.7, reflecting a high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality. No known exploits are currently reported in the wild, and no official patches have been released yet. The flaw's exploitation could facilitate further attacks such as credential theft, system compromise, or lateral movement within affected environments.

For European organizations using WeiPHP 5.0 to manage WeChat public accounts or related services, this vulnerability poses a significant risk. Successful exploitation can lead to unauthorized disclosure of sensitive internal files, including configuration details and source code, which may contain credentials, API keys, or business logic. This exposure can facilitate subsequent attacks such as privilege escalation, data breaches, or service disruption. Given the nature of WeiPHP as a platform for public-facing WeChat accounts, compromised servers could also lead to reputational damage and loss of customer trust. Additionally, organizations in sectors with strict data protection regulations like GDPR could face compliance violations and associated penalties if sensitive personal data is exposed. The unauthenticated and remote exploitation vector increases the threat level, as attackers do not require prior access or user interaction, making it easier to target vulnerable systems at scale.

Organizations should immediately audit their use of WeiPHP 5.0 and restrict access to the vulnerable endpoint where possible. Network-level controls such as web application firewalls (WAFs) should be configured to detect and block suspicious path traversal patterns in POST requests targeting the picUrl parameter. Input validation should be enforced by implementing strict whitelisting of allowed file paths and sanitizing user-supplied input to prevent directory traversal sequences (e.g., ../). Until an official patch is released, consider deploying virtual patching via WAF rules or disabling the affected functionality if feasible. Regularly monitor logs for anomalous access attempts to the /public/index.php/material/Material/_download_imgage endpoint. Additionally, conduct thorough security reviews of all publicly accessible endpoints and ensure that sensitive files are not stored in web-accessible directories. Organizations should also prepare incident response plans to quickly address any potential exploitation and consider isolating WeiPHP instances from critical internal networks.