{"id":"CVE-2025-65879","title":"Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability","summary":"Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH a…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-22"],"vendor":"yeqifu","product":"warehouse_management_system","affected":["warehouse_management_system <= 1.2"],"published":"2025-12-05","updated":"2026-09-25","sourceUpdated":"2026-09-25T23:10:00.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-65879","references":[{"url":"https://github.com/W000i/vuln/issues/3","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00792,"epssPercentile":0.54478,"ingestedAt":"2026-09-25T23:21:16.896Z","slug":"CVE-2025-65879","body":"## Overview\n\nWarehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.\n\n## Affected\n\n- `warehouse_management_system <= 1.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}