CVE-2025-65879: Yeqifu Warehouse Management System

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.

Affected products

• Yeqifu Warehouse Management System: up to and including 1.2

Published 2025-12-05. Last modified 2026-09-25.