CVE-2025-4175: AlanBinu007 Spring-Boot-Advanced-Projects Upload Profile API Endpoint UserProfileController.jav uploadUserProfileImage path traversal
First published: Thu May 01 2025(Updated: )
A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProfileImage of the file /Spring-Boot-Advanced-Projects-main/Project-4.SpringBoot-AWS-S3/backend/src/main/java/com/urunov/profile/UserProfileController.jav of the component Upload Profile API Endpoint. The manipulation of the argument File leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| AlanBinu007 Spring-Boot-Advanced-Projects | <=3.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4175?
CVE-2025-4175 is classified as a critical vulnerability.
How do I fix CVE-2025-4175?
To fix CVE-2025-4175, upgrade your Spring-Boot-Advanced-Projects to version 3.1.4 or later.
What is impacted by CVE-2025-4175?
CVE-2025-4175 affects all versions of AlanBinu007 Spring-Boot-Advanced-Projects up to and including 3.1.3.
What does CVE-2025-4175 exploit?
CVE-2025-4175 exploits the function uploadUserProfileImage in the specified Java file.
Who is the vendor of CVE-2025-4175?
The vendor of CVE-2025-4175 is AlanBinu007, the maintainer of Spring-Boot-Advanced-Projects.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/severity
- agent/tags
- agent/event
- vendor/alanbinu007
- canonical/alanbinu007 spring-boot-advanced-projects