YiShaAdmin: Unauthenticated path traversal in file download endpoint
Summary
YiShaAdmin versions 2.2 to 3.1, a .NET-based web admin system, contain an unauthenticated path traversal flaw in the /admin/File/DownloadFile endpoint. A remote attacker can send crafted GET requests to read arbitrary files, such as configuration files with credentials, and with the delete parameter set, to delete them. No login is required. Exploitation activity has been reported, but sources disagree on whether the flaw is known to be exploited.
Affected
- YiShaAdmin 2.2 to 3.1 (per CNA record)
- Forks and derived projects may be affected; check your own code base
- Scope for other maintained lines (.NET 6.0/7.0 variants) is not established
Fixed in
- Fix commits: 025b0628b1295bd2d9fd6c9b5b82692a345151ef (named as the fix in the CVE record) and c3b66e66bf6d70a561190cd8da7f4df7b141931d
- Fixed release version: Unknown.
- The commits add path filtering in FilterFilePath and DownloadFile; completeness of this filtering has not been independently verified.
Workaround
- No vendor workaround documented.
- Block access to the admin panel and file endpoints from the internet (VPN or IP allowlist).
- Run the application with minimal file-system rights.
Exploitation
- Exploitation evidence first observed by the Shadowserver Foundation on 2023-10-20 (reported).
- A public nuclei detection template exists, which makes finding vulnerable hosts easier.
- KEV status conflicting: VulnCheck lists it in its KEV feed; another source does not mark it as known exploited. No CISA KEV entry found.
- CVSS 4.0 base score 8.8; NVD analysis pending (Deferred).
Our recommendation
- Identify all hosts running YiShaAdmin, including forks, and check their versions.
- Update to a build that contains the fix commits and confirm they are in the deployed code.
- Remove internet exposure of the admin panel until patched.
- Review web logs for requests to /admin/File/DownloadFile with traversal sequences or unexpected deletions.
- If compromise cannot be excluded, rotate credentials and secrets stored on the host.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 025b062 (CVE-referenced) github.com
- Commit c3b66e6 github.com
- VulnCheck advisory www.vulncheck.com
- Nuclei detection template github.com
- Strix CVE summary www.strix.ai
- HOL Guard CVE page hol.org
- YiShaAdmin GitHub issue 178 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:56.
Original description (NVD)
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
NVD references (5)
- https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef
- https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml
- https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128
- https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.