CVE-2025-2708

A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. The manipulation of the argument path leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-endExploit, Third Party Advisory
• https://vuldb.com/?ctiid.300729Permissions Required, VDB Entry
• https://vuldb.com/?id.300729Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.517030Third Party Advisory, VDB Entry
• https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-endExploit, Third Party Advisory

Published

Mar 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27074Memory corruption while processing a GP command response.7.8
• CVE-2025-27075Memory corruption while processing IOCTL command with larger…7.8
• CVE-2025-27076Memory corruption while processing simultaneous requests via…7
• CVE-2025-27077Memory corruption while processing message in guest VM.7.8
• CVE-2025-27078A vulnerability in a system binary of AOS-8 Instant and AOS-…6.5
• CVE-2025-27079A vulnerability in the file creation process on the command …6
• CVE-2025-27080Vulnerabilities in the command line interface of AOS-CX coul…6
• CVE-2025-27081A potential security vulnerability in HPE NonStop OSM Servic…6.8
• CVE-2025-27082Arbitrary File Write vulnerabilities exist in the web-based …7.2
• CVE-2025-27083Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2025-27084A vulnerability in the Captive Portal of an AOS-10 GW and AO…6.1
• CVE-2025-27085Multiple vulnerabilities exist in the web-based management i…4.9