Vulnerability · Published Nov 17, 2025 · Assigned by VulDB

CVE-2025-13266wwwlike vlife VLifeApi SysFileApi.java create path traversal

Medium 5.3

In plain English

A medium-severity path traversal in vlife from wwwlike. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 49.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.github.wwwlike:vlife-base	no fix listed	GHSA-cg6m-9276-qpjj

Affected products (as reported)

Vendor	Product	Versions
wwwlike	vlife	2.0.02.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-332601 | wwwlike vlife VLifeApi SysFileApi.java create path traversal vdb-entry, technical-description
VDB-332601 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #689436 | vlife 2.0.1 Arbitrary File Read third-party-advisory
https://github.com/wwwlike/vlife/issues/3 exploit, issue-tracking