Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-1584
CVE-2025-1584:
Java vulnerability analysis and mitigation
Overview
A path traversal vulnerability was discovered in opensolon Solon versions up to 3.0.8, affecting the StaticMappings.java file in the solon-web-staticfiles component. The vulnerability was disclosed on February 23, 2025 and allows remote attackers to traverse directories using '../filedir' manipulation. The issue has been fixed in version 3.0.9 with patch f46e47fd1f8455b9467d7ead3cdb0509115b2ef1 (NVD, MITRE).
Technical details
The vulnerability exists in the StaticMappings.java file located at solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/. It has been assigned CVSS v4.0 score of 5.3 (Medium) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N and CVSS v3.1 score of 4.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-23 (Relative Path Traversal) and CWE-24 (Path Traversal: '../filedir') (NVD).
Impact
The vulnerability allows remote attackers to access files outside of the intended directory structure through path traversal manipulation. This could potentially lead to unauthorized access to sensitive files on the system (NVD).
Mitigation and workarounds
Users are recommended to upgrade to Solon version 3.0.9 which contains the fix for this vulnerability. The patch f46e47fd1f8455b9467d7ead3cdb0509115b2ef1 adds validation to prevent '../' path traversal attempts (GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management