CVE-2025-2744: zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal

Published Mar 25, 2025

Updated

A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

zhijiantianya ruoyi-vue-pro

Iocoder Ruoyi-vue-pro=2.4.1

Event History

Mar 25, 2025

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-2744?

CVE-2025-2744 is classified as a critical vulnerability.

How do I fix CVE-2025-2744?

To mitigate CVE-2025-2744, ensure that the component Material Upload Interface is updated to the latest version.

What type of attack can CVE-2025-2744 facilitate?

CVE-2025-2744 can lead to path traversal attacks due to improper handling of file arguments.

Which software versions are affected by CVE-2025-2744?

CVE-2025-2744 affects zhijiantianya ruoyi-vue-pro version 2.4.1.

Where can CVE-2025-2744 be exploited?

CVE-2025-2744 can be exploited in the /admin-api/mp/material/upload-news-image endpoint.