Cyber Posture

CVE-2025-2363

Medium

Published: 17 March 2025

Published
17 March 2025
Modified
14 October 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0043 62.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2025-2363 is a path traversal vulnerability (CWE-22) classified as critical in lenve VBlog up to version 1.0.0. The issue affects the uploadImg function within the file blogserver/src/main/java/org/sang/controller/ArticleController.java, where manipulation of the filename argument enables attackers to traverse directories outside the intended upload path.

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring network access (AV:N) and low complexity (AC:L) with no user interaction (UI:N). Successful exploitation results in limited impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), as scored at CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), potentially allowing unauthorized file access or modification in traversable directories.

Advisories from VulDB and a Notion page detail the vulnerability as an arbitrary file upload leading to path traversal, with the exploit publicly disclosed. No patches or vendor responses are available, as the vendor was contacted early but did not reply; security practitioners should restrict upload functionalities and validate filenames strictly.

The exploit has been made public and may be actively used, with no further details on real-world exploitation provided in available sources.

Details

CWE(s)
CWE-22

Affected Products

lenve
vblog
all versions

MITRE ATT&CK Enterprise Techniques

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1608.001 Upload Malware Resource Development
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

Path traversal in unrestricted file upload enables remote arbitrary file writes, facilitating public-facing app exploitation (T1190), web shell deployment (T1505.003), tool transfer into victim environment (T1105), and malware staging (T1608.001).

References