Vulnerability · Published Aug 10, 2025 · Assigned by VulDB

CVE-2025-8815猫宁i Morning Shiro Configuration index path traversal

High 7.3

In plain English

A high-severity path traversal in Morning from 猫宁i. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.7%top 46.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. It has been classified as critical. Affected is an unknown function of the file /index of the component Shiro Configuration. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Affected products (as reported)

Vendor	Product	Versions
猫宁i	Morning	bc782730c74ff080494f145cc363a0b4f43f7d3e

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-319344 | 猫宁i Morning Shiro Configuration index path traversal vdb-entry
VDB-319344 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #622348 | 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e Command Injection third-party-advisory
https://gitee.com/morning-pro/Morning/issues/ICOVAK exploit, issue-tracking