Vulnerability · Published Jul 11, 2025 · Assigned by VulDB

CVE-2025-7452kone-net go-chat Endpoint file_controller.go GetFile path traversal

Medium 6.3

In plain English

A medium-severity path traversal in go-chat from kone-net. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the argument fileName leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Affected products (as reported)

Vendor	Product	Versions
kone-net	go-chat	f9e58d0afa9bbdb31faf25e7739da330692c4c63

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-316096 | kone-net go-chat Endpoint file_controller.go GetFile path traversal vdb-entry, technical-description
VDB-316096 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #607818 | kone-net go-chat f9e58d0 Arbitrary File Read third-party-advisory
http://github.com/kone-net/go-chat/issues/14 issue-tracking
https://github.com/kone-net/go-chat/issues/14#issue-3195205637 exploit, issue-tracking