CVE-2025-3214 MEDIUM

CVE-2025-3214: JFinal CMS readTemplate engine.getTemplate path traversal

Vendor Jfinal
Product CMS
Weakness CWE-22 · Path traversal
Published April 4, 2025
Last update April 4, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that this is not a bug but a feature.

Key dates

02Disclosure timeline

April 4, 2025 CVE published
April 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-34079 Flatpak affected by arbitrary file deletion on the host filesystem CVE-2018-0405 Cisco RV180W Wireless-N Multifunction VPN Router Directory Path Traversal Vulnerability CVE-2026-6403 Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter CVE-2024-37513 WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability CVE-2023-32166 D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability