CVE-2025-4533

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-404

Affected software

Vendor	Product	Versions
n/a	JeecgBoot	3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8.0

References

https://github.com/jeecgboot/JeecgBoot/issues/8199Exploit, Issue Tracking, Third Party Advisory
https://github.com/jeecgboot/JeecgBoot/issues/8199#issue-3022937633Exploit, Issue Tracking, Third Party Advisory
https://github.com/jeecgboot/JeecgBoot/issues/8199#issuecomment-2834691016Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.308278Permissions Required, VDB Entry
https://vuldb.com/?id.308278Third Party Advisory, VDB Entry
https://vuldb.com/?submit.566192Third Party Advisory, VDB Entry

Timeline

Published: May 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-453317.5brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module CVE-2025-453327.5vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leadin CVE-2025-453337.5berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing modu CVE-2025-45343.7A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing.CVE-2025-453439.8An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module i CVE-2025-453468.1SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.CVE-2025-45355.3A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0.CVE-2025-45365.3A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affec CVE-2025-45373.1A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown funct CVE-2025-453754.4Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas CVE-2025-453767.8Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerabili CVE-2025-453789.1Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into