CVE-2025-2743: zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal

Published Mar 25, 2025

Updated

A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

zhijiantianya ruoyi-vue-pro

Iocoder Ruoyi-vue-pro=2.4.1

Event History

Mar 25, 2025

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

May 25, 58462

Event

via NVD·12:19 PM

Frequently Asked Questions

What is the severity of CVE-2025-2743?

CVE-2025-2743 is classified as problematic due to its impact on the Material Upload Interface in the affected software.

How do I fix CVE-2025-2743?

To fix CVE-2025-2743, it is recommended to update to the latest version of the ruoyi-vue-pro software that addresses this vulnerability.

What component is affected by CVE-2025-2743?

CVE-2025-2743 affects the Material Upload Interface of the ruoyi-vue-pro application.

Can CVE-2025-2743 lead to unauthorized access?

Yes, CVE-2025-2743 potentially allows for unauthorized file manipulation, which may lead to further exploitation.

Is CVE-2025-2743 actively exploited in the wild?

As of the latest information, there have been no confirmed reports of CVE-2025-2743 being actively exploited in the wild.