CVE-2025-6925

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.mdExploit, Third Party Advisory
• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md#steps-to-reproduceExploit, Third Party Advisory
• https://vuldb.com/?ctiid.314437Permissions Required, VDB Entry
• https://vuldb.com/?id.314437Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.600948Third Party Advisory, VDB Entry
• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.mdExploit, Third Party Advisory
• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md#steps-to-reproduceExploit, Third Party Advisory

Published

Jun 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69242Raytha CMS is vulnerable to reflected XSS via the backToList…6.1
• CVE-2025-69243Raytha CMS is vulnerable to User Enumeration in password res…5.3
• CVE-2025-69245Raytha CMS is vulnerable to Reflected XSS via returnUrl para…6.1
• CVE-2025-69246Raytha CMS does not have any brute force protection mechanis…9.8
• CVE-2025-69247free5GC go-upf is the User Plane Function (UPF) implementati…7.5
• CVE-2025-69248free5GC is an open-source project for 5th generation (5G) mo…7.5
• CVE-2025-69250free5gc UDM provides Unified Data Management (UDM) for free5…7.5
• CVE-2025-69251free5gc UDM provides Unified Data Management (UDM) for free5…5.3
• CVE-2025-69252free5gc UDM provides Unified Data Management (UDM) for free5…7.5
• CVE-2025-69253free5GC is an open-source project for 5th generation (5G) mo…5.3
• CVE-2025-69255RustFS is a distributed object storage system built in Rust.…4
• CVE-2025-69256The Serverless Framework is a framework for using AWS Lambda…7.5