Path Traversal Vulnerability in Zhijiantianya Ruoyi-Vue-Pro by Zhijiantianya

CVE-2025-2707

What is CVE-2025-2707?

A vulnerability has been identified in the Front-End Store Interface of Zhijiantianya's Ruoyi-Vue-Pro 2.4.1, specifically within the file upload functionality at /app-api/infra/file/upload. This flaw allows attackers to manipulate the argument path, leading to unauthorized access to files outside the intended directory. As a result, remote attackers could exploit this vulnerability to perform malicious actions. The vulnerability has been publicly disclosed, emphasizing the need for immediate remediation as the vendor has not yet acknowledged the issue.

References