CVE-2025-6925: Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6925?
CVE-2025-6925 is classified as a critical vulnerability in Dromara RuoYi-Vue-Plus 5.4.0.
Which component is affected by CVE-2025-6925?
CVE-2025-6925 affects the Mail Handler component in the file MailController.java.
How do I fix CVE-2025-6925?
To fix CVE-2025-6925, update Dromara RuoYi-Vue-Plus to the latest version that resolves this vulnerability.
What are the implications of exploiting CVE-2025-6925?
Exploitation of CVE-2025-6925 may allow unauthorized manipulation of email functionalities within the application.
Who is the vendor for CVE-2025-6925?
The vendor for CVE-2025-6925 is Dromara, responsible for the RuoYi-Vue-Plus framework.