Medium severity · published Jan 24, 2025
CVE-2025-0703
JoeyBling bootplus SysFileController.java path traversal
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects some unknown processing of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bootplus · JoeyBling
247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0703
Not Applicable
https://github.com/JoeyBling/bootplus/issues/25
Not Applicable
https://github.com/JoeyBling/bootplus/issues/25#issue-2786928618
Permissions Required
https://vuldb.com/?ctiid.293231
Third Party Advisory
https://vuldb.com/?id.293231
Third Party Advisory
https://vuldb.com/?submit.480842
More from bootplus
8.8
CVE-2025-0702
JoeyBling bootplus SysFileController.java unrestricted upload
8.8
CVE-2025-0701
JoeyBling bootplus list sql injection
8.8
CVE-2025-0700
JoeyBling bootplus list sql injection
8.8
CVE-2025-0699
JoeyBling bootplus list sql injection
8.8
CVE-2025-0698
JoeyBling bootplus list sql injection
