PT-2025-20655 · Unknown · Jeecg-Boot

Lem0N817

·

Published

2025-05-11

·

Updated

2025-10-02

·

CVE-2025-4533

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.8.0
Description A vulnerability was found in JeecgBoot that affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Recommendations For JeecgBoot versions up to 3.8.0, consider disabling the unzipFile function until a patch is available to prevent remote resource consumption. Restrict access to the /jeecg-boot/airag/knowledge/doc/import/zip file to minimize the risk of exploitation. Avoid using the File argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400CWE-404

Related Identifiers

CVE-2025-4533

Affected Products

Jeecg-Boot