by Kastro
Paper/Archive/CVE-2025-2707

CVE-2025-2707

zhijiantianya ruoyi-vue-pro — zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal

EPSS 0.7%public exploitCVSS 9.1
critical.is priorityof 100
48
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.2.542 × 2010.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.

Affected

ProductAffectedFixed inSource
ruoyi-vue-pro2.4.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulDB (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
VulDB (CNA)5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/vuln/300728refvuldb.com/vuln/300728/ctiwriteupvuldb.com/cve/CVE-2025-2707writeupvuldb.com/submit/517029exploitgithub.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#3file-path-traversal-front-endpatchgitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0refgitee.com/zhijiantianya/ruoyi-vue-pro