CVE-2025-2363 is a medium severity path traversal flaw (CVSS 6.3) in lenve VBlog up to 1.0.0, in the uploadImg function of ArticleController.java. The record names no fixed version and says the vendor did not respond. Review the code, validate file names, and keep the upload feature away from untrusted users.
What's affected
The NVD record names lenve VBlog up to and including 1.0.0. The affected function is uploadImg in blogserver/src/main/java/org/sang/controller/ArticleController.java, and the filename argument leads to path traversal. A write-up referenced by the record describes the issue in terms of arbitrary file upload, so expect both the name and the location of an uploaded file to matter.
The description says the exploit has been disclosed to the public and that the vendor was contacted early but did not respond. The record is not on the CISA Known Exploited Vulnerabilities list.
The weakness is classed as CWE-22 (path traversal). The score is 6.3 (MEDIUM). The vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reads as reachable over the network, low attack complexity, low privileges required and no user interaction. Impact is limited on confidentiality, limited on integrity and limited on availability. The record was published on 2025-03-17.
No fixed version is listed. Given the note that the vendor did not respond, do not expect one. If you run VBlog, plan to patch the code yourself or retire the feature.
How to check if you're exposed
VBlog is a Java project you build and run yourself, so check your own copy.
- Confirm you run VBlog at all, and which version or commit you built from.
- Look for the vulnerable function in your source.
grep -rn "uploadImg" --include=*.java .
- Read how the method uses the
filenamevalue. If it joins the value to a directory path without checking the result, you have the same pattern. - Review the upload directory for files that do not belong, such as scripts or files with unusual extensions or names that contain parent directory markers.
The vector shows low privileges are required, so also check who has an account that can reach the upload feature.
What to do now
- Find every VBlog deployment, including development servers.
- Restrict the image upload feature to trusted accounts, or disable it until it is fixed.
- Patch the code: ignore the client supplied file name, generate your own, and confirm the final path stays inside the upload directory.
- Make sure the upload directory cannot execute scripts and is not served as code by the web server.
- Review recent uploads for unexpected files, and rotate any credentials stored on the host if you find any.
Why it matters
Path traversal, listed as CWE-22, happens when an application builds a file path from user input and does not check where the result ends up. A name that climbs out of the intended folder can read or write files elsewhere on the disk. In an upload feature, that can mean placing a file where it should never be.
The more worrying part is the project state. With no response from the vendor and a public disclosure, anyone running this code carries the risk alone. That is common with small open source projects, and it is a good reason to track what you run, not only what you buy.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
How serious is a 6.3 score for an upload bug?
The score reflects low privileges and limited impact in the vector, so it lands in the medium band. File upload flaws can matter more than the number suggests when uploads land somewhere the server can execute, so check your own setup.
What is the safest fix in code?
Never trust the supplied file name. Create the stored name yourself, resolve the final path, and reject the request if it is not inside the upload directory.
Sources
- Safeguard Gold entry for CVE-2025-2363
- NVD record data for CVE-2025-2363 (published 2025-03-17)
- Reference listed in the CVE record
Last reviewed: 19 October 2026.
