CVE-2025-2708: zhijiantianya ruoyi-vue-pro Backend File Upload Interface upload path traversal

Published Mar 24, 2025

Updated

A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. The manipulation of the argument path leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

zhijiantianya ruoyi-vue-pro

Iocoder Ruoyi-vue-pro=2.4.1

Event History

Mar 24, 2025

CVE Published

via MITRE·07:31 PM

Data Sourced

via MITRE·07:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

May 25, 58462

Event

via NVD·11:38 AM

Frequently Asked Questions

What is the severity of CVE-2025-2708?

CVE-2025-2708 has been classified as a critical severity vulnerability.

How do I fix CVE-2025-2708?

To fix CVE-2025-2708, ensure that the application is updated to a version that addresses this vulnerability.

What is the impact of CVE-2025-2708?

CVE-2025-2708 allows for path traversal, potentially leading to unauthorized access to files on the server.

Which software is affected by CVE-2025-2708?

CVE-2025-2708 affects the zhijiantianya ruoyi-vue-pro version 2.4.1.

How can I determine if I am vulnerable to CVE-2025-2708?

To determine if you are vulnerable to CVE-2025-2708, check if you are using an affected version of the zhijiantianya ruoyi-vue-pro software.