Description
A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument fileName leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| openviglet | shio | 0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; 0.3.6; 0.3.7; 0.3.8 |
References
- https://github.com/openviglet/shio/issues/1028Exploit, Issue Tracking, Vendor Advisory
- https://github.com/openviglet/shio/issues/1028#issue-3239418750Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.318293Permissions Required, VDB Entry
- https://vuldb.com/?id.318293Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.617679Third Party Advisory, VDB Entry
- https://github.com/openviglet/shio/issues/1028Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Jul 31, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed