Executive brief
WebStack-Guns is an open-source navigation CMS framework. The application serves user-uploaded image files through an unauthenticated endpoint that fails to validate user input, allowing attackers to read arbitrary files from the server (such as database credentials or SSH keys) without authentication. This could lead to complete compromise of application and database security.
Technical details
A path traversal vulnerability (CWE-22) exists in the KaptchaController.renderPicture() method, which concatenates an unsanitized pictureId parameter directly to the upload directory path without validating for directory traversal sequences (.. or /). The /kaptcha/{pictureId} endpoint is explicitly exposed as an anonymous resource in ShiroConfig, allowing unauthenticated network access. An attacker can craft requests like GET /kaptcha/..%2f..%2f..%2f..%2fetc%2fpasswd to read arbitrary files readable by the application process, including configuration files containing database credentials. No patch is mentioned; remediation requires input validation, path canonicalization, or restricting the endpoint to authenticated users.
Affected products
- jsnjfz WebStack-Guns 1.0
Timeline
- 2025-12-01: disclosed: CVE-2025-13810 published; exploit made public on GitHub