A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code.
References
| Link | Resource |
|---|---|
| https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2020/CNVD-2020-68596.yaml | Exploit |
| https://vulncheck.com/advisories/weiphp-path-traversal-file-read | Exploit Third Party Advisory |
| https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596 | Third Party Advisory |
Configurations
History
23 Sep 2025, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Weiphp
Weiphp weiphp |
|
| CPE | cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:* | |
| References | () https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2020/CNVD-2020-68596.yaml - Exploit | |
| References | () https://vulncheck.com/advisories/weiphp-path-traversal-file-read - Exploit, Third Party Advisory | |
| References | () https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596 - Third Party Advisory |
26 Jun 2025, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-26 16:15
Updated : 2025-09-23 19:27
NVD link : CVE-2025-34045
Mitre link : CVE-2025-34045
CVE.ORG link : CVE-2025-34045
JSON object : View
Products Affected
weiphp
- weiphp