Which versions of WebStack-Guns are affected by CVE-2025-13810?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-13810, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access.

Is there a public PoC exploit available for CVE-2025-13810?

Yes, a public proof-of-concept exploit is available for CVE-2025-13810. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-13810?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

WebStack-Guns CVE-2025-13810

Q: What is the CVSS score of CVE-2025-13810?

CVE-2025-13810 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-199956 MEDIUM

Path Traversal (CWE-22)

2025-12-01 cna@vuldb.com

Java Path Traversal Webstack Guns Jsnjfz

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Public CAPTCHA endpoint requires no auth (PR:N, AV:N); traversal yields read-only file disclosure with low confidentiality impact and no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 03, 2026 - 03:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-199956

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Feb 24, 2026 - 07:16 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 07:16 cve.org

MEDIUM 5.5

CVE Published

Dec 01, 2025 - 07:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/controller/KaptchaController.java. Performing a manipulation results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in WebStack-Guns 1.0 exposes arbitrary server-side files to unauthenticated remote attackers through the CAPTCHA image rendering endpoint. The renderPicture function in KaptchaController.java fails to sanitize user-supplied file path input, allowing directory traversal sequences to escape the intended image directory and read sensitive files such as configuration files, credentials, or application source. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, leaving version 1.0 permanently unpatched.

Technical ContextAI

WebStack-Guns is a Java-based navigation/bookmark management web application built on the Guns framework (a popular Spring Boot scaffolding widely used in Chinese open-source projects). The vulnerability resides in KaptchaController.java at the renderPicture method, which is responsible for serving CAPTCHA images. Because CAPTCHA endpoints are inherently public-facing and unauthenticated, the path parameter accepted by renderPicture is reachable without any authentication. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the application constructs a file path from user-controlled input without normalizing or bounding it to a designated directory, enabling classic ../ traversal sequences. The affected CPE is cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch is available for WebStack-Guns 1.0 as of the time of analysis; the vendor did not respond to disclosure. The primary recommended action is to restrict network access to the affected CAPTCHA endpoint (/captcha/renderPicture or equivalent) at the reverse-proxy or firewall layer, blocking unauthenticated external access - note that this may break CAPTCHA display for end users if not selectively allowlisted. If the application must remain accessible, deploy a Web Application Firewall rule to detect and block path traversal patterns (e.g., ../ sequences) in query parameters on that endpoint. Where feasible, migrating to an actively maintained fork or replacing the CAPTCHA implementation entirely is the most durable remediation. The POC is documented at https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md and should be reviewed to understand exact attack parameters for tuning WAF rules.