CVE-2025-1588 is a medium severity path traversal flaw in PHPGurukul Online Nurse Hiring System 1.0. The profilepic argument in /admin/manage-nurse.php can reach files outside the intended folder. NVD scores it 6.5. The record names no patch, so restrict access and fix the path handling.
What's affected
The record lists Online Nurse Hiring System 1.0 from PHPGurukul. The weak script is /admin/manage-nurse.php, through the profilepic argument. No fixed version is named in the record or in the references we could read.
How to check if you're exposed
Find the script and see how it uses the argument.
find /var/www /srv -type f -name "manage-nurse.php" 2>/dev/null
grep -n "profilepic" $(find /var/www -type f -path "*/admin/manage-nurse.php" 2>/dev/null)
If the value is added to a folder path and passed to a file function without checks, the script is in the affected class. Also check for unusual requests in your logs.
grep "manage-nurse.php" /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null | tail -n 50
The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) shows the attack needs no account at all. Because none is needed, any internet facing copy is exposed.
What to do now
- Find every copy of Online Nurse Hiring System you run.
- Restrict the admin area to trusted networks, or take the app offline if it does not need to be public.
- In
/admin/manage-nurse.php, accept only a file name chosen from a known list, strip directory parts and refuse anything that resolves outside the target folder. - Run the web server under an account that can write only to the folders it needs.
- Check the file system and recent backups for missing or changed files.
- Watch for a vendor fix and plan a replacement if none comes.
Why it matters
The weakness is CWE-22, path traversal, with the related classes CWE-23 and CWE-24 also listed. The code builds a file path from input. If it does not check where the path ends up, special sequences in the input can climb out of the intended folder.
In this case the record scores the impact as integrity and availability only, which fits a file operation more than a data leak. The record says an exploit is public. It is not on the CISA KEV list.
Going further
Small PHP admin apps often reuse one pattern for every upload and delete feature. After you fix this script, search for other uses of file functions that take request values. The same mistake tends to repeat across a codebase.
File system permissions are a second layer. If the web user cannot write outside the upload folder, a path bug has less to damage. Review them as part of the fix.
Quick check
Is there a fixed version?
The record does not name one. Check the vendor site and fix the file handling in your copy.
What stops this class of bug?
Never join user input to a path directly. Map input to an allowed list of names, then resolve the final path and confirm it stays within the base folder.
Sources
Last reviewed: 19 October 2026.
