CVE-2025-2708

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
zhijiantianya	ruoyi-vue-pro	2.4.1

References

Timeline

Published: Mar 24, 2025
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-270806.0Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Succes CVE-2025-270816.8A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Ser CVE-2025-270827.2Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conduct CVE-2025-270837.2Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interfac CVE-2025-270846.1A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a ref CVE-2025-270854.9Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploi CVE-2025-270868.1A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.CVE-2025-270875.5A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack.CVE-2025-270888.2oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables atta CVE-2025-270894.3Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies CVE-2025-27096.1A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file CVE-2025-270905.3Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform secu