---
id: CVE-2025-2707
title: zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal
summary: >-
  A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This
  impacts an unknown function of the file /app-api/infra/file/upload of the
  component Front-End Store Interface. This manipulation of the argument path
  causes path t…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-22
vendor: zhijiantianya
product: ruoyi-vue-pro
affected:
  - ruoyi-vue-pro 2.4.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-03-24T19:28:48.371612Z'
exploitAvailable: true
published: '2025-03-24'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:09:38.335Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-2707'
references:
  - url: 'https://vuldb.com/vuln/300728'
    label: >-
      VDB-300728 | zhijiantianya ruoyi-vue-pro Front-End Store upload path
      traversal
  - url: 'https://vuldb.com/vuln/300728/cti'
    label: 'VDB-300728 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2025-2707'
    label: CVE-2025-2707 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/517029'
    label: >-
      Submit #517029 | zhijiantianya ruoyi-vue-pro 2.4.1 File Path Traversal
      Front-end
  - url: >-
      https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#3file-path-traversal-front-end
  - url: >-
      https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0
  - url: 'https://gitee.com/zhijiantianya/ruoyi-vue-pro/'
tags:
  - cve.org
  - exploit-available
epss: 0.00729
epssPercentile: 0.5404
ingestedAt: '2026-10-26T16:31:40.057Z'
---

## Overview

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.

## Affected

- `ruoyi-vue-pro 2.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.