CVE-2025-8343 is a medium severity path traversal flaw (CVSS 4.3) in Viglet Shio up to 0.3.8. The fileName argument of the static file pre-upload function is not constrained to its intended folder. No fixed version is confirmed in the sources reviewed, so check the project issue tracker and restrict access.
What's affected
Affected: openviglet Viglet Shio, versions up to 0.3.8, per the NVD record. The weak spot is shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java (function shStaticFilePreUpload), driven by the fileName argument.
The record scores this 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The CNA description (VulDB) calls it "critical", which is VulDB's own rating wording and not the CVSS band. Both are stated here; this post uses the CVSS score.
Fixed versions: none confirmed. The sources I reviewed (the NVD record) do not name a patched release or a vendor advisory. Check the vendor or project site for a newer release before assuming a fix exists.
The record lists the weakness as CWE-22 (path traversal). Gold has the full entry for CVE-2025-8343.
Exploitation status: the record says the exploit details have been disclosed publicly and could be used. CVE-2025-8343 is not listed in the CISA Known Exploited Vulnerabilities catalog per the record, and none of the pages I read claims exploitation in the wild.
How to check if you're exposed
Shio is a Java project, so check the version your build uses.
# Maven
mvn dependency:tree | grep -i shio
# Gradle
gradle dependencies | grep -i shio
# a deployed jar
find / -name "shio*.jar" 2>/dev/null
Anything at 0.3.8 or earlier falls inside the range in the record. Then read the code around ShStaticFileAPI.java in your copy and see whether the file name value is checked before it is used. You can also paste a manifest into the free in-browser dependency scan to see what else is outdated.
What to do now
- Limit who can reach the Shio upload endpoints. Put them behind authentication and a network allow list.
- Check the project issue tracker and releases for a version newer than 0.3.8 and read its notes before upgrading.
- If you maintain a fork, resolve the final path of the requested file name and reject anything that falls outside the intended directory.
- Run the Shio process as a low privilege user so it can only write where it needs to.
- Review file system and access logs for unexpected writes outside the static files folder.
Why it matters
Path traversal means a file name supplied by a user is joined to a directory path without checking where the result lands. Instead of staying in the intended folder, the operation can reach other places on the server. The record maps this to CWE-22. Its CVSS score is moderate at 4.3 because of the privileges and conditions in the vector, but the flaw still deserves a fix.
Static file upload code is a common home for this bug. Normalizing the path, comparing it with the allowed base directory, and refusing anything outside it closes the whole class.
Quick check
Is there a patched version of Viglet Shio?
None is confirmed in the sources reviewed. The NVD record lists up to 0.3.8 as affected, and no vendor advisory was found. Check the vendor site before relying on any fix.
Is CVE-2025-8343 being exploited in the wild?
The record does not mark it as a known exploited vulnerability, and no advisory I read says so. The record does say exploit details were disclosed publicly, so assume that attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-8343
- NVD record data for CVE-2025-8343, published 2025-07-31, CVSS 4.3
Last reviewed: 18 October 2026.
