CVE-2025-4118 is a medium severity access control flaw (CVSS 5.3) in Weitong Mall 1.0.0. The isDelete argument of the /historyList product history handler lets a remote caller bypass intended limits. I could not confirm a fix, so restrict the endpoint.
What's affected
The CVE record names Weitong Mall 1.0.0. The affected part is the /historyList path of the Product History Handler component, and the argument involved is isDelete.
The record states that the exploit has been disclosed to the public and may be used. It does not say the flaw is being exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
I found no vendor advisory or fixed version in the record. The references are VulDB entries and a blog post, so check the project repository for a newer release.
How to check if you're exposed
Confirm you run Weitong Mall and which version. The record names 1.0.0, so treat that and any older version as affected.
Test the handler in a staging copy. Check whether an unauthenticated or low privilege user can reach the history list functions, and whether the server decides what a user may do, or trusts the value the client sends.
Review application logs for calls to /historyList with unexpected isDelete values from accounts that should not use them.
What to do now
- Identify all Weitong Mall deployments and versions.
- Check the project repository for a release after 1.0.0 that addresses the issue.
- Restrict the history handler to authenticated users and enforce checks on the server for every action.
- Put a rule at your proxy to block the path if the feature is not in use.
- Review data for unexpected deletions or changes in product history.
Why it matters
The record lists CWE-266, incorrect privilege assignment, and CWE-284, improper access control. In plain terms, the server lets a caller do something that the caller should not be allowed to do, based on a value the caller supplies.
The impact in the vector is limited to low confidentiality loss, which is why the score is medium. Even so, access control bugs are easy to miss in testing because the page works normally for legitimate users. The rule to take away is that the server must decide what a user can do, never the request.
Quick check
Is CVE-2025-4118 exploited in the wild?
The record says the exploit is public, but it is not on the CISA KEV list and I found no report of active exploitation.
Is there a patch?
I could not confirm one. The record references no vendor advisory, so check the project directly.
Sources
Last reviewed: 18 October 2026.
