Vulnerability · Published Feb 24, 2026 · Assigned by VulDB

CVE-2025-15589MuYuCMS Template Management Template.php delete_dir_file path traversal

Low 3.8

In plain English

A low-severity path traversal in MuYuCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	MuYuCMS	2.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-336710 | MuYuCMS Template Management Template.php delete_dir_file path traversal vdb-entry, technical-description
VDB-336710 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #702489 | MuYuCMS 2.7 Directory Traversal third-party-advisory
https://gist.github.com/b1uel0n3/275ac353537ecf4c8973d33fa0d5b0fe related
https://gist.github.com/b1uel0n3/275ac353537ecf4c8973d33fa0d5b0fe#proof-of-concept exploit