Listen to this Post
How the CVE Works
CVE-2025-2744 is a critical path traversal vulnerability in Ruoyi-Vue-Pro 2.4.1, specifically in the Material Upload Interface (/admin-api/mp/material/upload-news-image). The flaw occurs due to improper validation of the `File` parameter, allowing attackers to manipulate file paths remotely. By crafting malicious requests, an attacker can traverse directories and upload or overwrite arbitrary files on the server. This could lead to remote code execution (RCE), data leakage, or system compromise. The vulnerability is exploitable without authentication, increasing its severity.
DailyCVE Form
Platform: Ruoyi-Vue-Pro
Version: 2.4.1
Vulnerability: Path Traversal
Severity: Critical
Date: 2025-03-25
Prediction: Patch expected by 2025-08-30
What Undercode Say
Analytics:
curl -X POST -F "[email protected]" http://target/admin-api/mp/material/upload-news-image
import requests
requests.post("http://target/admin-api/mp/material/upload-news-image", files={"file": ("../../malicious.php", payload)})
How Exploit
- Craft a malicious file with directory traversal sequences (e.g.,
../../../malicious.php). - Upload via the vulnerable endpoint to overwrite system files.
- Trigger the uploaded payload for RCE.
Protection from this CVE
- Apply vendor patch (when released).
- Restrict file upload permissions.
- Implement input sanitization.
Impact:
- Remote Code Execution (RCE).
- Unauthorized file access/modification.
- System compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
