Path Traversal

org.noear:solon-web-staticfiles is vulnerable to Path Traversal. The vulnerability is due to improper validation of user-supplied file paths in StaticMappings.java, allowing an attacker to access arbitrary files using "../filedir"...

com.easy-flowable:easy-flowable-solon-plugin (>=1.0.0, <=1.0.2), com.luomor.pcsms:pcsms-solon-plugin-example (>=1.0.0, <=1.0.1) +17 more potentially affected by CVE-2025-1584 via org.noear:solon-web-staticfiles (>=2.9.2-m1, <=3.0.9-m2)

org.noear:solon-web-staticfiles MAVEN version =2.9.2-m1, =1.0.0, =1.0.0, =2024.3.0, =1.3.0-m1, =20250107, =3.3.4, =1.8.4-m1, =1.3.1, =1.7.8, =1.8.0, =2.9.2-m1, =2.9.2-m1, =2.9.2-m1, =2.9.2-m1, =3.0.9-m2 and more Source cves: CVE-2025-1584 Source advisory: MEND:CVE-2025-1584...

CVE-2025-1584: Path Traversal: '../filedir'

A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal:...