by Kastro CVE-2025-8343
openviglet shio — openviglet shio ShStaticFileAPI.java shStaticFilePreUpload path traversal
Description · from the CVE record
A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument fileName leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected
ProductAffectedFixed inSource
shio0.3.0–CNA
shio0.3.1–CNA
shio0.3.2–CNA
shio0.3.3–CNA
shio0.3.4–CNA
shio0.3.5–CNA
shio0.3.6–CNA
shio0.3.7–CNA
shio0.3.8–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
VulDB (CNA)4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
VulDB (CNA)4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial