CVE-2025-15449 is a medium severity path traversal (CVSS 5.4) in JavaMall. The delete function of MinioController.java trusts the objectName argument, letting a logged in user reach files they should not. Rolling releases mean no version is named and no fix is confirmed. Restrict the endpoint.
What's affected
The record names cld378632668 JavaMall up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The function is delete in src/main/java/com/macro/mall/controller/MinioController.java, and the argument is objectName. The record says the manipulation causes path traversal and can be started remotely.
The project ships rolling releases, so no affected or fixed version numbers exist. The vendor did not respond to disclosure. The related upload flaw is CVE-2025-15448, in the same controller.
The CVSS vector needs a low privilege account and shows impact on integrity and availability, not confidentiality. That fits a delete operation: the risk is removing or damaging stored objects.
How to check if you're exposed
Check how your deployment works out which commit it runs:
git merge-base --is-ancestor 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 HEAD && echo "includes the affected commit"
Then check your object storage. If delete requests can name arbitrary paths, one account might remove another tenant's files. Review the bucket's versioning and backup status: with versioning on, a deleted object can be restored, and without it the loss is permanent.
Look in application logs for delete calls whose objectName contains parent directory markers or paths outside your normal prefixes.
What to do now
- Find out which JavaMall commit you run and compare it with the one in the record.
- Turn on versioning or backups in the MinIO bucket so deleted objects can be recovered.
- Change the delete handler to resolve names against a fixed prefix and reject anything that escapes it, if you maintain the code.
- Limit which accounts can call delete and scope each account to its own prefix.
- Monitor for the upstream fix, and plan a switch if the project stays silent.
Why it matters
The record lists CWE-22, Path Traversal. The handler accepts a name from the request and uses it as a path without confirming that the final location stays inside the allowed area. In object storage the same mistake shows up as keys that reach other tenants' prefixes.
The score is 5.4: network reachable, low privileges, with integrity and availability impact. It is not in CISA's Known Exploited Vulnerabilities catalog per the record. The practical risk is data loss, which good backups turn from an incident into an annoyance.
Quick check
What does this flaw let someone do?
The record describes path traversal in the delete function. The CVSS impact is on integrity and availability, which fits removing or damaging objects.
Why is no version number given?
JavaMall uses rolling releases, so the record says affected and fixed versions are not available. Compare commits instead.
Sources
Last reviewed: 19 October 2026.
