GCVE - cpe:2.3:a:iocoder:ruoyi-vue-pro:2.4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:iocoder:ruoyi-vue-pro:2.4.1:*:*:*:*:*:*:*

part: a version: 2.4.1 update: *

Vendor	Iocoder (`c00d4da0-9bef-567d-bee3-9d707233bfdc`)
Product	Ruoyi Vue Pro (`aeb6b139-b9a9-57ed-9f25-7b771b0c08c0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/yunaiv/ruoyi-vue-pro`	purl2cpe	2026-06-01 10:15:33.687490

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-2744`	vulnerable	2026-06-08 07:16:58.161296	zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal MEDIUM (5.4) A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-25T07:00:11.929Z Updated: 2025-03-31T17:56:42.094Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300846 https://vuldb.com/?ctiid.300846 https://vuldb.com/?submit.519694 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#7arbitrary-file-deletion-vulnerability---uploadnewsimage	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2743`	vulnerable	2026-06-08 07:16:58.160936	zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal MEDIUM (4.3) A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-25T07:00:10.362Z Updated: 2025-03-25T13:14:50.779Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300845 https://vuldb.com/?ctiid.300845 https://vuldb.com/?submit.519692 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#6arbitrary-file-deletion-vulnerability---uploadtemporarymaterial	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2742`	vulnerable	2026-06-08 07:16:58.160527	zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal MEDIUM (5.4) A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-25T06:31:07.259Z Updated: 2025-03-25T13:15:33.938Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300844 https://vuldb.com/?ctiid.300844 https://vuldb.com/?submit.519691 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2708`	vulnerable	2026-06-08 07:16:58.113611	zhijiantianya ruoyi-vue-pro Backend File Upload Interface upload path traversal MEDIUM (5.4) A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. The manipulation of the argument path leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-24T19:31:03.576Z Updated: 2025-03-24T20:06:17.827Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300729 https://vuldb.com/?ctiid.300729 https://vuldb.com/?submit.517030 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#4file-path-traversal-back-end	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2707`	vulnerable	2026-06-08 07:16:58.112981	zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal MEDIUM (5.4) A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-24T19:00:06.004Z Updated: 2025-03-24T19:29:01.196Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300728 https://vuldb.com/?ctiid.300728 https://vuldb.com/?submit.517029 https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#3file-path-traversal-front-end	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2040`	vulnerable	2026-06-08 07:14:57.809501	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.