PT-2025-29344 · Unknown · Springboot Mybatisplus

Bi8Bu · Published 2025-07-12 · Updated 2025-07-12 · CVE-2025-7488

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JoeyBling SpringBoot MyBatisPlus versions up to a6a825513bd688f717dbae3a196bc9c9622fea26

Description: A critical vulnerability exists in the Download function of the /file/download endpoint. Manipulation of the Name argument allows for path traversal. This issue can be exploited remotely, and the exploit has been publicly disclosed. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /file/download endpoint. Sanitize the Name argument to prevent path traversal attempts.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-7488

Affected Products

Springboot Mybatisplus

References · 9

• 🔥 https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7488 · Security Note
• https://vuldb.com/?ctiid.316138 · Note
• https://twitter.com/CVEnew/status/1944118938650259618 · Twitter Post
• https://t.me/cvenotify/128715 · Telegram Post
• https://vuldb.com/?submit.609343 · Note
• https://vuldb.com/?id.316138 · Note
• https://twitter.com/VulmonFeeds/status/1944137440781873314 · Twitter Post
• https://t.me/cvetracker/27655 · Telegram Post