CVE-2025-4178

A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.java of the component File Upload API. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

• CWE-22

• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-02.mdExploit
• https://vuldb.com/?ctiid.306797Permissions Required, VDB Entry
• https://vuldb.com/?id.306797Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.561794Exploit, Third Party Advisory, VDB Entry
• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-02.mdExploit

Published

May 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41768An high privileged remote attacker can inject arbitrary cont…5.5
• CVE-2025-41769The device's PROFINET service is affected by a buffer overfl…9.8
• CVE-2025-4177The Flynax Bridge plugin for WordPress is vulnerable to unau…5.3
• CVE-2025-41770An unauthenticated denial-of-service vulnerability in the de…7.5
• CVE-2025-41771An authenticated attacker with low privileges can access an …5.3
• CVE-2025-41772An unauthenticated remote attacker can obtain valid session …7.5
• CVE-2025-4179The Flynax Bridge plugin for WordPress is vulnerable to limi…7.3
• CVE-2025-4180A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4181A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4182A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4183A vulnerability classified as critical has been found in PCM…9.8
• CVE-2025-4184A vulnerability classified as critical was found in PCMan FT…9.8