# CVE-2025-0225

## Summary

- **CVE ID:** CVE-2025-0225
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-25, CWE-23
- **Published:** Jan 5, 2025
- **Last Modified:** Mar 13, 2026

## Description

A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

## Affected Products

- Tsinghua Unigroup — Electronic Archives System (3.2.210802(62532))

## References

- [CNA](https://vuldb.com/?id.290215)
- [CNA](https://vuldb.com/?ctiid.290215)
- [CNA](https://vuldb.com/?submit.474264)
- [CNA](https://github.com/BxYQ/ld/tree/main/file_read4)
- [CNA](https://github.com/BxYQ/ld/blob/main/file_read4/poc.py)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.47%
- **EPSS Percentile:** 39.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._