Cyber Posture

CVE-2025-2707

MediumPublic PoC

Published: 24 March 2025

Published
24 March 2025
Modified
15 July 2025
KEV Added
—
Patch
—
CVSS Score 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0017 37.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-2707 is a critical path traversal vulnerability (CWE-22) affecting zhijiantianya ruoyi-vue-pro version 2.4.1. The issue resides in an unknown functionality of the Front-End Store Interface component, specifically the /app-api/infra/file/upload endpoint, where manipulation of the 'path' argument enables traversal outside intended directories. It carries a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) and was published on 2025-03-24.

The vulnerability can be exploited remotely by low-privileged authenticated users (PR:L) with low attack complexity and no user interaction required. Successful exploitation allows partial integrity and availability impacts, potentially enabling attackers to write or overwrite files in unauthorized locations via path traversal, though confidentiality is unaffected.

Advisories from VulDB and a GitHub security disclosure note that the exploit has been publicly released and may be actively used. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are mentioned in the available references.

Details

CWE(s)
CWE-22

Affected Products

iocoder
ruoyi-vue-pro
2.4.1

MITRE ATT&CK Enterprise Techniques

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1098.004 SSH Authorized Keys Persistence
Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

The path traversal vulnerability in the front-end file upload endpoint (/app-api/infra/file/upload) enables exploitation of a public-facing application (T1190), ingress tool/malware transfer to arbitrary filesystem locations (T1105), persistence through web shell deployment (T1505.003), and account manipulation via overwriting SSH authorized keys (T1098.004).

References