CVE-2025-66480: Wildfire IM im-server Path Traversal in File Upload
CVE-2025-66480 is a critical path traversal flaw in the im-server component of Wildfire IM, affecting versions before 1.4.3. The file upload endpoint does not strip directory traversal sequences from user-supplied filenames, which can allow arbitrary file writes on the server. The vendor fixed the issue in version 1.4.3, and the record reports a CVSS 3.1 base score of 9.8.
Overview
CVE-2025-66480 affects the im-server component of Wildfire IM, an instant messaging and real-time audio/video solution. The file upload handling in the UploadFileAction class does not remove directory traversal sequences from the filename supplied in the upload request. The vendor's advisory states that the issue is fixed in version 1.4.3.
Impact
The record describes a path traversal that can let a remote attacker write files to arbitrary locations the application process can write to. The record states that this may lead to remote code execution and full server compromise, for example by overwriting configuration files. The CVSS 3.1 base score of 9.8 reflects network-reachable exploitation with no privileges or user interaction required, and high impact to confidentiality, integrity and availability, as indicated by the vector in the record.
Affected products and versions
- Wildfirechat Im-server before 1.4.3 (record range: < 1.4.3).
The record does not list further affected version details beyond this range.
Exploitation status
The CISA KEV catalog entry is not listed in the record. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade im-server to version 1.4.3 or later, as indicated by the vendor release and the fix commit.
- Review the patch commit and the vendor advisory to confirm the changes applied to the upload handling.
- Until patching is possible, restrict access to the upload endpoint at the network level to trusted clients only. This is a general defensive measure, not a vendor-stated workaround.
- Run the application process with the least filesystem permissions required, limiting the locations it can write to.
Detection guidance
- Review web and application logs for requests to the upload endpoint that contain unusual or path-like filenames.
- Monitor the server filesystem for newly created or modified files in unexpected directories, including system configuration and scheduled task locations.
- Check integrity of sensitive files such as SSH authorized keys and cron configuration on hosts running im-server.
Limitations of the available information
The record does not include detailed exploit conditions, proof-of-concept material, or exploitation telemetry. The record contains no EPSS or SSVC data. Whether the endpoint is exposed in a given deployment, and what the process's write permissions are, are unknown from the record.
Frequently asked questions
What is CVE-2025-66480?
It is a critical path traversal vulnerability in the im-server component of Wildfire IM, in its file upload functionality, affecting versions before 1.4.3.
Which version fixes the issue?
The record and the vendor references indicate that version 1.4.3 contains the fix.
Is this vulnerability actively exploited?
The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Upgrade im-server to version 1.4.3 or later, and restrict access to the upload endpoint until the update is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.