CVE-2025-2708 zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal

Medium 5.3 Published 24 Mar 2025 Updated 26 Oct 2026

Attackers can exploit a path traversal flaw in the file upload interface to read or modify arbitrary files on the server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-2708?

CVE-2025-2708 is a medium-severity path traversal vulnerability in zhijiantianya ruoyi-vue-pro, published on 24 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

Weakness: CWE-22

Which versions are affected by CVE-2025-2708?

It affects 1 product.

Products include Iocoder Ruoyi-Vue-Pro.

How do I fix CVE-2025-2708?

No fix has been published for CVE-2025-2708 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-2708 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2708 exists.

Sources

Also known as GHSA-f6qj-5j3v-gwmm.