CVE-2025-6925

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-6925

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6925.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-6925

Published

2025-06-30T18:15:26.617Z

Modified

2026-04-10T05:36:39.517832Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Git / github.com/dromara/ruoyi-vue-plus

Affected ranges

Type

GIT

Repo

https://github.com/dromara/ruoyi-vue-plus

Events

Introduced

Last affected

d22b2a10dff0e6552bc648adaeca62f01d9b590f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.4.0"
        }
    ]
}

Affected versions

v5.*

v5.0.0

v5.1.0

v5.2.1

v5.2.2

v5.2.3

v5.3.0

v5.3.1

v5.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6925.json"