CVE-2025-2707

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-270707.8Memory corruption while performing encryption and decryption commands.CVE-2025-270719.8Memory corruption while processing specific files in Powerline Communication Firmware.CVE-2025-270725.5Information disclosure while processing a packet at EAVB BE side with invalid header length.CVE-2025-270737.5Transient DOS while creating NDP instance.CVE-2025-270747.8Memory corruption while processing a GP command response.CVE-2025-270757.8Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.CVE-2025-270767.0Memory corruption while processing simultaneous requests via escape path.CVE-2025-270777.8Memory corruption while processing message in guest VM.CVE-2025-270786.5A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the u CVE-2025-270796.0A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remot CVE-2025-27089.1A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file CVE-2025-270806.0Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Succes