Executive brief
PerfreeBlog, a Java-based content management system, contains a security flaw in its theme management component. An attacker can exploit this to delete any file on the server, potentially leading to a complete website outage or the loss of critical system data. This could disrupt business operations and require significant recovery efforts if backups are not available.
Technical details
An arbitrary file deletion vulnerability exists in PerfreeBlog v4.0.11 within the `unInstallTheme` function. The application fails to properly validate or sanitize the `themePath` parameter before using it in file system operations. By supplying directory traversal sequences (e.g., `../../`), a remote attacker can escape the intended theme directory and delete arbitrary files on the host server. While the CVSS vector suggests some user interaction (UI:R), the technical report indicates the vulnerability is reachable via a direct API request to `/api/auth/theme/unInstallTheme`. Successful exploitation can lead to data loss or denial of service by deleting critical application or system files.
Affected products
- Perfree PerfreeBlog 4.0.11
Timeline
- 2025-10-24: advisory: NVD published the CVE record.