Is there a public PoC exploit available for CVE-2025-8343?

Yes, a public proof-of-concept exploit is available for CVE-2025-8343. Prioritise patching immediately. EPSS: 0.2%.

OpenViglet Shio CVE-2025-8343

Q: What is the CVSS score of CVE-2025-8343?

CVE-2025-8343 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

LOW

Path Traversal (CWE-22)

2025-07-31 cna@vuldb.com

Java Path Traversal Shio

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:18 vuln.today

DescriptionCVE.org

A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument fileName leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Path traversal in OpenViglet Shio up to version 0.3.8 allows authenticated remote attackers to read arbitrary files by manipulating the fileName parameter in the shStaticFilePreUpload API endpoint. The vulnerability has low practical impact (CVSS 2.1, EPSS 0.22%) despite being rated critical in severity classification, as it requires prior authentication and provides only limited confidentiality exposure. Public exploit code is available.

Technical ContextAI

The vulnerability exists in the ShStaticFileAPI.java file, specifically the shStaticFilePreUpload function which processes file upload requests. The root cause is improper input validation on the fileName parameter (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), allowing attackers to use path traversal sequences (e.g., ../) to access files outside the intended upload directory. This is a Java-based REST API endpoint that fails to canonicalize or restrict file paths before file operations. The affected product is OpenViglet Shio, a Java content management system, identified by CPE cpe:2.3:a:viglet:shio:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade OpenViglet Shio to a patched version released after 0.3.8. Check the official GitHub repository (https://github.com/openviglet/shio) for the latest release. Until patching is possible, implement the following compensating controls: restrict network access to the /api/staticfile endpoint to trusted networks or a reverse proxy with strict input validation; enforce strong authentication policies to minimize the number of users who can initiate file uploads; implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (../, ..\ patterns) in the fileName parameter; enable file system access controls to limit the shio application process to read-only access outside its designated upload directory, preventing full file system traversal even if the API vulnerability is exploited. Note that WAF rules may create false positives if legitimate filenames contain similar patterns, requiring careful testing before production deployment.