File Download Vulnerability in JoeyBling SpringBoot_MyBatisPlus
CVE-2025-7488

5.3MEDIUM

Key Information:

Vendor

Joeybling

Status
Springboot Mybatisplus
Vendor
CVE Published:
12 July 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-7488?

A vulnerability exists in the JoeyBling SpringBoot_MyBatisPlus product that allows for path traversal via the Download function of the /file/download endpoint. This vulnerability enables attackers to manipulate the input argument 'Name,' potentially leading to unauthorized file access on the server. The vulnerability can be exploited remotely, indicating a significant risk for users of the affected product. It is crucial for organizations relying on continuous delivery and rolling releases to be aware of this issue, as specific version information for affected releases is not available.

Affected Version(s)

SpringBoot_MyBatisPlus a6a825513bd688f717dbae3a196bc9c9622fea26

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-7488 - Proof of Concept

References

https://vuldb.com/?id.316138
vdb-entrytechnical-description
https://vuldb.com/?ctiid.316138
signaturepermissions-required
https://vuldb.com/?submit.609343
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

bi8bu (VulDB User)
.
CVE-2025-7488 : File Download Vulnerability in JoeyBling SpringBoot_MyBatisPlus