CVE-2025-4533 JeecgBoot Document Library Upload zip unzipFile resource consumption
Remote attackers can cause resource exhaustion in JeecgBoot via malicious zip uploads in the Document Library, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4533?
CVE-2025-4533 is a medium-severity denial of service vulnerability in Jeecg Jeecg Boot, published on 11 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-4533?
It affects 1 product.
Products include Jeecg Jeecg Boot.
How do I fix CVE-2025-4533?
No fix has been published for CVE-2025-4533 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-4533 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4533 exists.
Other vulnerabilities in Jeecg Jeecg Boot
Sources
Also known as GHSA-63pw-wwh5-pgr6.