CVE-2025-8815: High Path Traversal in Morning CMS

CVE-2025-8815 is a high severity path traversal in Morning, a content management project from morning-pro, through its Shiro configuration. The record covers commits up to bc782730c74ff080494f145cc363a0b4f43f7d3e and gives no fixed version, because the product uses rolling releases. No fix is confirmed.

What's affected

• Product: morning-pro Morning, up to commit bc782730c74ff080494f145cc363a0b4f43f7d3e.
• Component: the /index route in the Shiro configuration.
• Weakness: CWE-22 (path traversal).
• Score: CVSS 3.1 base 7.3, High, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. It is network reachable and needs no privileges.
• Fixed version: none. The record says rolling releases are used, so no version details of affected or updated releases are available.

The sources describe this differently. The record says path traversal with a High score. The public report I could read, filed on the project's Gitee tracker on 25 July 2025, says an unauthenticated remote command execution results from a weak Apache Shiro access rule combined with unsafe deserialization in the Fastjson library, and that the affected endpoint is reachable through a path under a static resources route. It says all versions are affected. Both describe a way past the access rules, but the report claims a more serious end result than the record's score reflects. Gitee also shows a content risk marker on that page.

The record says the exploit has been disclosed publicly. It does not flag exploitation in the wild, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.

How to check if you're exposed

Check whether your site runs this project and which commit it was built from.

git log --oneline | head
git merge-base --is-ancestor bc782730c74ff080494f145cc363a0b4f43f7d3e HEAD && echo "contains the affected commit"

Then inspect the Shiro filter chain definition. You are looking for anonymous rules that cover whole path prefixes, such as a static resource route, and for any way a request to a protected path can be matched against an open rule instead.

Finally, check your dependency list for the Fastjson library and its version.

mvn dependency:tree | grep -i -E "fastjson|shiro"

Old Fastjson releases have a long history of deserialization problems, so being on an old version is a finding by itself.

What to do now

1. Do not expose a stock copy of Morning to the internet until you have reviewed it.
2. Update Apache Shiro and Fastjson to current maintained releases, or replace Fastjson with a safer parser.
3. Rewrite the filter chain so that everything is denied by default and only named routes are open, and normalize paths before matching.
4. Put a reverse proxy in front that rejects unusual path forms before they reach the application.
5. Run the application under an unprivileged account with limited network access.
6. Watch the project for changes, and expect to carry your own patch.

Why it matters

Path traversal in an access control layer is dangerous because every protection that follows depends on the layer deciding correctly. If a request can be made to look like a public static file to the filter and a protected route to the application, the rules never apply.

The report adds the second ingredient: a deserialization library that does too much with the data it is given. Together they turn a bypass into something much worse. Reviewing both layers is the practical response, and the same applies to any Shiro based project you inherit.

You can run the free in-browser dependency scan at gold.safeguard.sh/scan on your manifests to see which known-vulnerable packages you carry. It reads dependencies, so it will not see a flaw that lives only in an application's own source.

Quick check

Sources

• Safeguard Gold entry: CVE-2025-8815 (NVD record data: description, CVSS, CWEs, published 2025-08-10)
• Issue listed in the record: Morning issue on Gitee

Last reviewed: 18 October 2026.