Vulnerability · Published Jul 14, 2025 · Assigned by VulDB

CVE-2025-7575Zavy86 WikiDocs submit.php image_delete_ajax path traversal

Medium 4.7

In plain English

A medium-severity path traversal in WikiDocs from Zavy86. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
Zavy86	WikiDocs	1.0.671.0.681.0.691.0.701.0.711.0.721.0.731.0.74

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-316273 | Zavy86 WikiDocs submit.php image_delete_ajax path traversal vdb-entry, technical-description
VDB-316273 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #609096 | Zavy86 WikiDocs 1.0.77 Administrator Arbitrary File Deletion via Path Traversal third-party-advisory
https://github.com/Zavy86/WikiDocs/pull/258 issue-tracking
https://github.com/Zavy86/WikiDocs/commit/98ea9ee4a2052c4327f89d2f7688cc1b5749450d patch
https://github.com/Zavy86/WikiDocs/releases/tag/1.0.78 patch