CVE-2025-4868: merikbest ecommerce-spring-reactjs File Upload Endpoint admin path traversal
First published: Sun May 18 2025(Updated: )
A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v1/admin/ of the component File Upload Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| merikbest ecommerce-spring-reactjs | <=464e610bb11cc2619cf6ce8212ccc2d1fd4277fd |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4868?
CVE-2025-4868 has been rated as critical.
What component is affected by CVE-2025-4868?
CVE-2025-4868 affects the File Upload Endpoint functionality in the /api/v1/admin/ file.
How do I fix CVE-2025-4868?
To fix CVE-2025-4868, update the merikbest ecommerce-spring-reactjs software to a version beyond 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd.
What versions of the software are affected by CVE-2025-4868?
CVE-2025-4868 affects versions of the merikbest ecommerce-spring-reactjs software up to and including version 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd.
What types of vulnerabilities does CVE-2025-4868 involve?
CVE-2025-4868 involves vulnerabilities related to file upload functionalities.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/merikbest
- canonical/merikbest ecommerce-spring-reactjs