CVE-2025-14520 is a medium severity path traversal (CVSS 5.4) in baowzh hfly up to the stated commit. The CVE record says the exploit is public. No fixed version is confirmed, so the safe course is to take it off the internet, restrict access and fix the input handling.
What's affected
The record lists baowzh hfly, all builds up to commit 638ff9abe9078bc977c132b37acbe1900b63491c.
The weak spot is the file /admin/index.php/datafile/delfile, through the argument filename. The record calls the function unknown, which means the advisory does not give a precise code line. That is typical for reports on this kind of small PHP project.
The record says the product uses a rolling release model, so there are no version numbers for affected or updated releases. It also says the vendor was contacted early and did not respond. Treat it as unpatched unless you can see a commit that changes the handling of this input.
How to check if you're exposed
This is application source you deploy yourself, so there is no package manager entry to query. Work from the files.
First confirm you run the product and version in the record. Look in the project folder for a readme, a version note or the download page you used. Then search the code for the affected file and the argument.
grep -rn "delfile" /var/www/
Swap the path for your web root. If the file exists and handles the filename value as the record describes, you match the description. Next, check your web server logs for requests to that file that you do not recognize.
grep "delfile" /var/log/nginx/access.log | tail -n 50
Use your own log path. Odd characters, very long values or a burst of requests to one page deserve a closer look. You can also run the free in-browser dependency scan on any package manifests that ship with the project.
What to do now
- Find every copy of hfly you or your team run, including test and demo servers.
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you can fix it.
- Change the handler so it accepts only a known list of file names, resolves the final path and refuses anything outside the intended folder.
- Check logs and the database for signs of use, and rotate any passwords stored by the application.
- Pin your deployment to a commit you have reviewed, watch the project repository and the linked reports for a patch, and re-scan once you change the code.
Why it matters
Path traversal happens when a file name supplied by a user is joined to a folder path without checking where the result lands. The weakness is CWE-22 (path traversal). Here the record names the filename argument of the delfile function, and the linked write-up calls it an arbitrary file delete.
Deleting files may sound minor, but removing a configuration file, a lock file or an upload can break the site or reset its safeguards. The score of 5.4 reflects a need for a low privilege login. The CVE is not on the CISA Known Exploited Vulnerabilities list, though the record says a public exploit exists.
Quick check
How do you stop a file name from escaping its folder?
Accept only names from a known list or a strict pattern, resolve the full path, and refuse any result that is not inside the intended folder.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14520
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-11, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
