CVE-2025-2708

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

• CWE-22

• https://gitee.com/zhijiantianya/ruoyi-vue-pro/
• https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0
• https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-endExploit, Third Party Advisory
• https://vuldb.com/cve/CVE-2025-2708
• https://vuldb.com/submit/517030
• https://vuldb.com/vuln/300729
• https://vuldb.com/vuln/300729/cti
• https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-endExploit, Third Party Advisory

Published

Mar 24, 2025

Last Modified

Oct 26, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27074Memory corruption while processing a GP command response.7.8
• CVE-2025-27075Memory corruption while processing IOCTL command with larger…7.8
• CVE-2025-27076Memory corruption while processing simultaneous requests via…7
• CVE-2025-27077Memory corruption while processing message in guest VM.7.8
• CVE-2025-27078A vulnerability in a system binary of AOS-8 Instant and AOS-…6.5
• CVE-2025-27079A vulnerability in the file creation process on the command …6
• CVE-2025-27080Vulnerabilities in the command line interface of AOS-CX coul…6
• CVE-2025-27081A potential security vulnerability in HPE NonStop OSM Servic…6.8
• CVE-2025-27082Arbitrary File Write vulnerabilities exist in the web-based …7.2
• CVE-2025-27083Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2025-27084A vulnerability in the Captive Portal of an AOS-10 GW and AO…6.1
• CVE-2025-27085Multiple vulnerabilities exist in the web-based management i…4.9