---
id: CVE-2025-2708
title: zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal
summary: >-
  A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected
  is an unknown function of the file /admin-api/infra/file/upload of the
  component Backend File Upload Interface. Such manipulation of the argument
  path leads to…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-22
vendor: zhijiantianya
product: ruoyi-vue-pro
affected:
  - ruoyi-vue-pro 2.4.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-03-24T20:06:13.990371Z'
exploitAvailable: true
published: '2025-03-24'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:09:50.452Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-2708'
references:
  - url: 'https://vuldb.com/vuln/300729'
    label: >-
      VDB-300729 | zhijiantianya ruoyi-vue-pro Backend File Upload upload path
      traversal
  - url: 'https://vuldb.com/vuln/300729/cti'
    label: 'VDB-300729 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2025-2708'
    label: CVE-2025-2708 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/517030'
    label: >-
      Submit #517030 | zhijiantianya ruoyi-vue-pro 2.4.1 File Path Traversal
      Backend
  - url: >-
      https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-end
  - url: >-
      https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0
  - url: 'https://gitee.com/zhijiantianya/ruoyi-vue-pro/'
tags:
  - cve.org
  - exploit-available
epss: 0.00744
epssPercentile: 0.54546
ingestedAt: '2026-10-26T16:31:40.058Z'
---

## Overview

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

## Affected

- `ruoyi-vue-pro 2.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.