PT-2025-3872 · Reggie · Reggie

Lvzc4

·

Published

2025-01-12

·

Updated

2025-10-21

·

CVE-2025-0401

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions 1902756969 reggie version 1.0
Description A critical vulnerability has been found in the download function of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the name argument leads to path traversal, allowing attackers to potentially access sensitive files or directories. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations For version 1.0, as a temporary workaround, consider restricting access to the download function in the CommonController.java file until a patch is available. Avoid using the name argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-0401

Affected Products

Reggie