CVE-2025-2744

A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#7arbitrary-file-deletion-vulnerability---uploadnewsimageExploit, Third Party Advisory
• https://vuldb.com/?ctiid.300846Permissions Required, VDB Entry
• https://vuldb.com/?id.300846Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.519694Third Party Advisory, VDB Entry

Published

Mar 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27434Due to insufficient input validation, SAP Commerce (Swagger …8.8
• CVE-2025-27435Under specific conditions and prerequisites, an unauthentica…4.2
• CVE-2025-27436The Manage Bank Statements in SAP S/4HANA does not perform r…4.3
• CVE-2025-27437A Missing Authorization Check vulnerability exists in the Vi…4.3
• CVE-2025-27438A vulnerability has been identified in Teamcenter Visualizat…7.8
• CVE-2025-27439Buffer underflow in some Zoom Workplace Apps may allow an au…8.8
• CVE-2025-27440Heap overflow in some Zoom Workplace Apps may allow an authe…8.8
• CVE-2025-27441Cross site scripting in some Zoom Workplace Apps may allow a…5.2
• CVE-2025-27442Cross site scripting in some Zoom Workplace Apps may allow a…5.2
• CVE-2025-27443Insecure default variable initialization in some Zoom Workpl…5.5
• CVE-2025-27444A reflected XSS vulnerability in RSform!Pro component 3.0.0 …4.8
• CVE-2025-27445A path traversal vulnerability in RSFirewall component 2.9.7…5.4