CVE-2025-1946 is a medium severity (6.3) command injection in hzmanyun Education and Training System 2.1. The exportPDF function at /user/exportPDF passes the id argument into a command in an unsafe way. The record names no fix, so restrict access and review how the argument is used.
What's affected
The record lists hzmanyun Education and Training System, version 2.1. The vulnerable function is exportPDF, reached at the path /user/exportPDF, and the argument involved is id. The weaknesses are CWE-77, improper neutralization of special elements used in a command, and CWE-74, the broader injection class.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity and a low privilege account required. The description says the exploit has been disclosed to the public and may be used. The record is not on the CISA Known Exploited Vulnerabilities list, and I found no source that says it is being exploited in the wild.
Fixed versions: none are named. I could not confirm a vendor patch. Check with the vendor and read the public report listed in the record.
How to check if you're exposed
Confirm that you run hzmanyun and which version. The record names 2.1 here and 2.1.3 for the sibling issue CVE-2025-1947.
Then check whether the export path is reachable from where it should not be.
grep "exportPDF" /var/log/nginx/access.log | less
Adjust the log path for your web server. Look for calls to that path from addresses outside your user base, calls from accounts that do not use exports, and unusually long or odd id values. If you have the source, search for where the id argument ends up. A value that is joined into a command string for a PDF tool or any shell call is the pattern behind this weakness.
Also check what account the application runs as. A web application running as an administrator turns a small bug into a large one.
What to do now
- Find every deployment of the system and record its version.
- Limit access to the application to the users who need it, using a VPN or allowlist where you can.
- Disable the PDF export feature if you do not need it, or block the path at the proxy until a fix is available.
- In the code, pass the id as a typed number to a library call, not through a shell. If a command is unavoidable, use an argument list with no shell and an allowlist of values.
- Run the application as an unprivileged account with limited file and network access.
- Review logs and the server for unexpected processes or files.
- Ask the vendor for a patched release and tell them about CVE-2025-1947 as well.
Why it matters
Command injection happens when input becomes part of a command line. The shell cannot tell where the programmer's text ends and the visitor's begins. The usual fix is to avoid the shell entirely, so that input is only ever data handed to a function.
Exports and file conversions are common places for this bug, since they call outside tools to do the work. The id looks harmless because it is a number in normal use. The server must still enforce that, because the request can contain anything.
Quick check
Why is an id parameter a risk if it is a number?
The server receives text from the request, not a number. Unless it converts and validates the value, anything the sender types reaches the code that builds the command.
Can I just filter special characters?
Blocklists are fragile. Prefer to avoid the shell, pass arguments as a list, and accept only values from a strict allowlist.
Sources
- CVE-2025-1946 on Safeguard Gold
- Public report listed in the CVE record (GitHub write-up). I could not retrieve it while writing.
Last reviewed: 19 October 2026.
