PT-2025-12770 · Zhijiantianya · Ruoyi-Vue-Pro

Uglory · Published 2025-03-25 · Updated 2025-08-25 · CVE-2025-2743

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions zhijiantianya ruoyi-vue-pro version 2.4.1

Description A problematic issue has been found in the Material Upload Interface component, affecting the processing of the file /admin-api/mp/material/upload-temporary. The manipulation of the File argument leads to path traversal. This issue can be exploited remotely.

Recommendations For zhijiantianya ruoyi-vue-pro version 2.4.1, as a temporary workaround, consider restricting access to the /admin-api/mp/material/upload-temporary endpoint to minimize the risk of exploitation. Avoid using the File argument in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2743

Affected Products

Ruoyi-Vue-Pro

References · 13

• 🔥 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#6arbitrary-file-deletion-vulnerability---uploadtemporarymaterial · Exploit
• https://osv.dev/vulnerability/CVE-2025-2743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2743 · Security Note
• https://twitter.com/CVEnew/status/1904432087266120126 · Twitter Post
• https://t.me/cvenotify/116030 · Telegram Post
• https://vuldb.com/?submit.519692 · Note
• https://t.me/cvenotify/128059 · Telegram Post
• https://t.me/cvetracker/19855 · Telegram Post
• https://t.me/cveNotify/133314 · Telegram Post
• https://vuldb.com/?ctiid.300845 · Note
• https://t.me/cvenotify/128048 · Telegram Post
• https://vuldb.com/?id.300845 · Note
• https://t.me/cvedetector/21056 · Telegram Post