CVE-2025-5509 is a medium severity path traversal in quequnlong shiyi-blog, a blogging application, up to version 1.2.1. The file or source argument of /api/file/upload can point outside the intended folder. The reporter says the maintainer did not respond, so no fixed version is known.
What's affected
- Product: quequnlong shiyi-blog.
- Affected: up to and including 1.2.1.
- Component: the file upload endpoint
/api/file/upload, arguments file and source. - Fixed version: none is named in the record. The reporter says the vendor was contacted early and did not respond in any way.
- Authentication: the vector requires low privileges, so a logged in account is needed.
The same project has two other CVEs published the same day, CVE-2025-5510 (server-side request forgery) and CVE-2025-5512 (improper authentication). Review all three together if you run this software.
How to check if you're exposed
Check which version of shiyi-blog you deploy, from the project's release tag, your build files or the Docker image.
git describe --tags 2>/dev/null
grep -n "version" pom.xml | head -5
Look at web server logs for requests to the upload path from addresses you do not recognize, and at the upload directory for files you did not expect. If you built the application from source, check your own copy for local changes that already address the path handling.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
What to do now
- Confirm whether you run shiyi-blog and which version.
- Check the project repository for a fix newer than 1.2.1. None is named in the record.
- Restrict the upload endpoint to trusted users, and put it behind additional access control such as a VPN or an authenticating proxy.
- Run the application with a service account that can write only to its upload folder.
- If you maintain a fork, validate and canonicalize the destination path on the server, and reject any value containing path separators.
Why it matters
Path traversal lets a request name a location outside the folder the code intends to use. With a file upload feature that matters twice over, because a write outside the upload directory can overwrite configuration or place files where they will be served or executed.
The defenses are simple but must be applied on the server: build the destination from a fixed base directory and a generated file name, resolve the final path, and verify it still sits inside the base. A project without an active maintainer response is a risk of its own. Plan on controlling access, or moving to a maintained alternative.
The weakness is classed as CWE-22 (Path Traversal). Severity in the CVE record: medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Quick check
Is there a fix?
None is named in the record, and the reporter says the maintainer did not respond. Check the repository yourself and restrict access.
Are other flaws in the same project?
Yes. CVE-2025-5510 and CVE-2025-5512 were published the same day for the same software versions.
Sources
- Researcher write-up on GitHub (listed in the CVE record, not fetched)
- VulDB entry 310923 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
