CVE-2025-5381

CVE-2025-5381 is a high-severity path traversal vulnerability affecting Yifang CMS up to version 2.0.2, specifically within the downloadFile function of the Admin Panel. This flaw allows an authenticated attacker to remotely manipulate the 'File' argument, potentially leading to unauthorized access to sensitive files or system compromise. With a CVSS score of 7.2, the vulnerability is easily exploitable over the network with high impact on confidentiality, integrity, and availability. While the exploit has been publicly disclosed, there is currently no evidence of active exploitation, nor are there readily available Metasploit or Nuclei modules, and it has garnered minimal community discussion or media coverage.