Cyber Posture

CVE-2025-2743

MediumPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
25 August 2025
KEV Added
Patch
CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0031 54.3th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may delete files left behind by the actions of their intrusion activity.

Security Summary

CVE-2025-2743 is a path traversal vulnerability (CWE-22) affecting zhijiantianya ruoyi-vue-pro version 2.4.1. The issue resides in the Material Upload Interface, specifically the /admin-api/mp/material/upload-temporary endpoint, where manipulation of the File argument enables traversal outside intended directories. Rated at CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), it was published on 2025-03-25 and classified as problematic.

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), such as an authenticated user, over the network with low complexity and no user interaction required. Successful exploitation allows limited access to confidential data (C:L), potentially enabling unauthorized file reads via path traversal, though the precise impact aligns with the low confidentiality score and no disruption to integrity or availability.

Advisories from VulDB (ctiid.300845, id.300845) and a GitHub repository (uglory-gll/javasec) detail the issue, with the latter providing a proof-of-concept under "Arbitrary File Deletion Vulnerability - uploadTemporaryMaterial," indicating public disclosure of an exploit. The vendor was contacted early but has not responded or issued patches. No mitigations are specified in available references.

Details

CWE(s)
CWE-22

Affected Products

iocoder
ruoyi-vue-pro
2.4.1

MITRE ATT&CK Enterprise Techniques

T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
Why these techniques?

Path traversal in material upload endpoint enables direct volume access (T1006) and arbitrary file deletion (T1070.004).

References