Description
A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.
Published: 2025-03-24
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-8007 A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
References

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.
Title zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal
First Time appeared Zhijiantianya
Zhijiantianya ruoyi-vue-pro
CPEs cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*
Vendors & Products Zhijiantianya
Zhijiantianya ruoyi-vue-pro
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

 cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Tue, 15 Jul 2025 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Iocoder
Iocoder ruoyi-vue-pro
CPEs cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:2.4.1:*:*:*:*:*:*:* cpe:2.3:a:iocoder:ruoyi-vue-pro:2.4.1:*:*:*:*:*:*:*
Vendors & Products Zhijiantianya
Zhijiantianya ruoyi-vue-pro
Iocoder
Iocoder ruoyi-vue-pro

Wed, 09 Jul 2025 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Zhijiantianya
Zhijiantianya ruoyi-vue-pro
CPEs cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:2.4.1:*:*:*:*:*:*:*
Vendors & Products Zhijiantianya
Zhijiantianya ruoyi-vue-pro

Mon, 24 Mar 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Mar 2025 19:15:00 +0000

Type Values Removed Values Added
Description A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Iocoder Ruoyi-vue-pro
Zhijiantianya Ruoyi-vue-pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T16:09:38.335Z

Reserved: 2025-03-24T11:23:28.194Z

Link: CVE-2025-2707

cve-icon Vulnrichment

Updated: 2025-03-24T19:28:56.110Z

cve-icon NVD

Status : Modified

Published: 2025-03-24T19:15:50.963

Modified: 2026-10-26T17:17:11.203

Link: CVE-2025-2707

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')