{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2708",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-24T20:06:13.990371Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-24T20:06:17.827Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            references: [
               {
                  tags: [
                     "exploit",
                  ],
                  url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-end",
               },
            ],
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               modules: [
                  "Backend File Upload Interface",
               ],
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. The manipulation of the argument path leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
            },
            {
               lang: "de",
               value: "Es wurde eine kritische Schwachstelle in zhijiantianya ruoyi-vue-pro 2.4.1 gefunden. Betroffen hiervon ist ein unbekannter Ablauf der Datei /admin-api/infra/file/upload der Komponente Backend File Upload Interface. Dank der Manipulation des Arguments path mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 5.5,
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Path Traversal",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-24T19:31:03.576Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-300729 | zhijiantianya ruoyi-vue-pro Backend File Upload Interface upload path traversal",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.300729",
            },
            {
               name: "VDB-300729 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.300729",
            },
            {
               name: "Submit #517030 | zhijiantianya ruoyi-vue-pro 2.4.1 File Path Traversal Backend",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.517030",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-end",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-24T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-24T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-24T15:49:00.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro Backend File Upload Interface upload path traversal",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2708",
      datePublished: "2025-03-24T19:31:03.576Z",
      dateReserved: "2025-03-24T11:23:30.412Z",
      dateUpdated: "2025-03-24T20:06:17.827Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2742",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-25T13:15:29.275960Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-25T13:15:33.938Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            references: [
               {
                  tags: [
                     "exploit",
                  ],
                  url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial",
               },
            ],
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               modules: [
                  "Material Upload Interface",
               ],
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
            },
            {
               lang: "de",
               value: "In zhijiantianya ruoyi-vue-pro 2.4.1 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei /admin-api/mp/material/upload-permanent der Komponente Material Upload Interface. Mittels dem Manipulieren des Arguments File mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 5.5,
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Path Traversal",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-25T06:31:07.259Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-300844 | zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.300844",
            },
            {
               name: "VDB-300844 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.300844",
            },
            {
               name: "Submit #519691 | zhijiantianya ruoyi-vue-pro 2.4.1 Arbitrary file deletion vulnerability --uploadPermanentMaterial",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.519691",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-24T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-24T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-24T15:49:28.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2742",
      datePublished: "2025-03-25T06:31:07.259Z",
      dateReserved: "2025-03-24T14:44:17.093Z",
      dateUpdated: "2025-03-25T13:15:33.938Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2040",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-06T20:23:20.541970Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-06T20:23:45.787Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
            },
            {
               lang: "de",
               value: "In zhijiantianya ruoyi-vue-pro 2.4.1 wurde eine kritische Schwachstelle entdeckt. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /admin-api/bpm/model/deploy. Dank Manipulation mit unbekannten Daten kann eine improper neutralization of special elements used in a template engine-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 6.5,
                  vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-1336",
                     description: "Improper Neutralization of Special Elements Used in a Template Engine",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-791",
                     description: "Incomplete Filtering of Special Elements",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-06T20:00:12.464Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-298783 | zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine",
               tags: [
                  "vdb-entry",
               ],
               url: "https://vuldb.com/?id.298783",
            },
            {
               name: "VDB-298783 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.298783",
            },
            {
               name: "Submit #512574 | https://gitee.com/zhijiantianya/ruoyi-vue-pro ruoyi-vue-pro 2.4.1 SSTI",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.512574",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-06T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-06T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-06T10:32:49.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2040",
      datePublished: "2025-03-06T20:00:12.464Z",
      dateReserved: "2025-03-06T09:27:39.518Z",
      dateUpdated: "2025-03-06T20:23:45.787Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2744",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:56:27.178776Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:56:42.094Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               modules: [
                  "Material Upload Interface",
               ],
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
            },
            {
               lang: "de",
               value: "Es wurde eine Schwachstelle in zhijiantianya ruoyi-vue-pro 2.4.1 gefunden. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /admin-api/mp/material/upload-news-image der Komponente Material Upload Interface. Durch das Manipulieren des Arguments File mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 5.5,
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Path Traversal",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-25T07:00:11.929Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-300846 | zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.300846",
            },
            {
               name: "VDB-300846 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.300846",
            },
            {
               name: "Submit #519694 | zhijiantianya ruoyi-vue-pro 2.4.1 Arbitrary file deletion vulnerability --uploadNewsImage",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.519694",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#7arbitrary-file-deletion-vulnerability---uploadnewsimage",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-24T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-24T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-24T15:49:31.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2744",
      datePublished: "2025-03-25T07:00:11.929Z",
      dateReserved: "2025-03-24T14:44:22.862Z",
      dateUpdated: "2025-03-31T17:56:42.094Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2707",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-24T19:28:48.371612Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-24T19:29:01.196Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               modules: [
                  "Front-End Store Interface",
               ],
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
            },
            {
               lang: "de",
               value: "Eine kritische Schwachstelle wurde in zhijiantianya ruoyi-vue-pro 2.4.1 entdeckt. Betroffen davon ist ein unbekannter Prozess der Datei /app-api/infra/file/upload der Komponente Front-End Store Interface. Durch Beeinflussen des Arguments path mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 5.5,
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Path Traversal",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-24T19:00:06.004Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-300728 | zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.300728",
            },
            {
               name: "VDB-300728 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.300728",
            },
            {
               name: "Submit #517029 | zhijiantianya ruoyi-vue-pro 2.4.1 File Path Traversal Front-end",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.517029",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#3file-path-traversal-front-end",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-24T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-24T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-24T15:48:46.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2707",
      datePublished: "2025-03-24T19:00:06.004Z",
      dateReserved: "2025-03-24T11:23:28.194Z",
      dateUpdated: "2025-03-24T19:29:01.196Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2743",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-25T13:14:46.543762Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-25T13:14:50.779Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            references: [
               {
                  tags: [
                     "exploit",
                  ],
                  url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#6arbitrary-file-deletion-vulnerability---uploadtemporarymaterial",
               },
            ],
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               modules: [
                  "Material Upload Interface",
               ],
               product: "ruoyi-vue-pro",
               vendor: "zhijiantianya",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.1",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "uglory (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
            },
            {
               lang: "de",
               value: "Eine Schwachstelle wurde in zhijiantianya ruoyi-vue-pro 2.4.1 entdeckt. Sie wurde als problematisch eingestuft. Davon betroffen ist unbekannter Code der Datei /admin-api/mp/material/upload-temporary der Komponente Material Upload Interface. Mittels Manipulieren des Arguments File mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 4,
                  vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Path Traversal",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-25T07:00:10.362Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-300845 | zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.300845",
            },
            {
               name: "VDB-300845 | CTI Indicators (IOB, IOC, TTP, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.300845",
            },
            {
               name: "Submit #519692 | zhijiantianya ruoyi-vue-pro 2.4.1 Arbitrary file deletion vulnerability --uploadTemporaryMaterial",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.519692",
            },
            {
               tags: [
                  "exploit",
               ],
               url: "https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#6arbitrary-file-deletion-vulnerability---uploadtemporarymaterial",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-24T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-03-24T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-03-24T15:49:30.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2025-2743",
      datePublished: "2025-03-25T07:00:10.362Z",
      dateReserved: "2025-03-24T14:44:19.914Z",
      dateUpdated: "2025-03-25T13:14:50.779Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}