baowzh hfly CVE-2025-14520

No vendor-released patch with a confirmed fix version has been identified at time of analysis due to the vendor's non-responsiveness and rolling release model. Security teams should: (1) Review the commit history of baowzh hfly repository after 638ff9abe9078bc977c132b37acbe1900b63491c for any patches to /admin/index.php/datafile/delfile's filename parameter handling, particularly implementation of path canonicalization and whitelisting; (2) As immediate compensating controls, restrict network access to /admin/* endpoints using a Web Application Firewall or reverse proxy, allowing only known administrative IP addresses; (3) Implement strict input validation on the filename parameter to reject path traversal sequences (../, ..\, absolute paths starting with / or drive letters); (4) Apply the principle of least privilege to the PHP execution user, ensuring it cannot delete critical system files; (5) Enable and monitor access logs for DELETE requests to /admin/index.php/datafile/delfile with unusual filename patterns. These controls trade operational flexibility for security; restrict administrative access carefully to avoid blocking legitimate operations.