CVE-2025-2707

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
zhijiantianya	ruoyi-vue-pro	2.4.1

References

Timeline

Published: Mar 24, 2025
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-270707.8Memory corruption while performing encryption and decryption commands.CVE-2025-270719.8Memory corruption while processing specific files in Powerline Communication Firmware.CVE-2025-270725.5Information disclosure while processing a packet at EAVB BE side with invalid header length.CVE-2025-270737.5Transient DOS while creating NDP instance.CVE-2025-270747.8Memory corruption while processing a GP command response.CVE-2025-270757.8Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.CVE-2025-270767.0Memory corruption while processing simultaneous requests via escape path.CVE-2025-270777.8Memory corruption while processing message in guest VM.CVE-2025-270786.5A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the u CVE-2025-270796.0A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remot CVE-2025-27089.1A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/uploa CVE-2025-270806.0Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Succes