CVE-2025-5381 is a path traversal vulnerability identified in Yifang CMS versions up to 2.0.2, specifically within the Admin Panel component's downloadFile function located at /api/File/downloadFile. The vulnerability arises from improper validation or sanitization of the 'File' argument, which allows an attacker to manipulate the file path input to traverse directories outside the intended scope. This can enable unauthorized access to arbitrary files on the server's filesystem. The vulnerability is remotely exploitable without requiring user interaction or authentication, as indicated by the CVSS vector (AV:N/AC:L/AT:N/UI:N/PR:H). However, it does require high privileges (PR:H), meaning the attacker must have some level of authenticated access with elevated permissions to exploit it. The CVSS score of 5.1 (medium severity) reflects this balance between ease of exploitation and impact. The vulnerability does not affect confidentiality, integrity, or availability directly but can lead to information disclosure by reading sensitive files. No patches or exploit code are currently publicly available, and no known exploits in the wild have been reported. The vulnerability was published on May 31, 2025, and is classified as problematic due to the potential for unauthorized file access within the CMS environment.

For European organizations using Yifang CMS versions 2.0.0 through 2.0.2, this vulnerability poses a moderate risk primarily related to unauthorized information disclosure. Attackers with elevated privileges could exploit the path traversal flaw to access sensitive configuration files, credentials, or other critical data stored on the CMS server. This could lead to further compromise or lateral movement within the network. While the vulnerability does not directly allow remote code execution or denial of service, the exposure of sensitive files can undermine the confidentiality and integrity of organizational data. European organizations in sectors such as government, finance, healthcare, and critical infrastructure that rely on Yifang CMS for content management may face increased risk, especially if internal access controls are weak or if attackers can escalate privileges to the required level. The lack of public exploits reduces immediate risk, but the public disclosure means attackers could develop exploits, increasing the threat over time.

Organizations should immediately audit their use of Yifang CMS and identify any installations running affected versions (2.0.0 to 2.0.2). Since no official patches are currently available, mitigation should focus on restricting access to the Admin Panel and the /api/File/downloadFile endpoint to trusted administrators only, ideally via network segmentation and firewall rules. Implement strict access controls and monitor for unusual file access patterns or attempts to exploit path traversal. Employ web application firewalls (WAFs) with custom rules to detect and block path traversal payloads targeting the 'File' parameter. Additionally, review and harden CMS configuration to minimize sensitive file exposure and ensure logging is enabled for audit trails. Organizations should engage with Yifang CMS vendors for updates or patches and plan for timely application once released. Finally, conduct regular security assessments and penetration testing to detect any exploitation attempts.