CVE-2025-2708 is a Medium severity (CVSS 5.4) path traversal in ruoyi-vue-pro 2.4.1, in the back end file upload interface at /admin-api/infra/file/upload. The record says the vendor did not respond, so no fix is known. Limit who can reach the endpoint.
What's affected
The record lists one affected release: zhijiantianya ruoyi-vue-pro version 2.4.1. The affected function is the file upload at /admin-api/infra/file/upload, in the back end store interface, and the path argument is the weak point.
The record states the vendor was contacted early and did not respond in any way. No fixed version appears in the record or the write up it links to, so check the project repository for later releases and read their change notes yourself.
The sibling CVE for the other upload interface is CVE-2025-2707. If you run this project, review both paths together.
How to check if you're exposed
Find out which version you run. For a Java project built with Maven, look at the project version in the build file, and at the deployed jar name:
grep -m3 "version" pom.xml
ls -l *.jar 2>/dev/null
Then look at how the upload controller uses the path value. If it joins that value to a storage directory without normalising the result and checking it stays inside the directory, the pattern in the record applies.
grep -rn "infra/file/upload\|FileController" --include=*.java . | head
Check your access logs for requests to /admin-api/infra/file/upload where the path value contains parent directory sequences or odd characters.
grep "file/upload" access.log | grep -E "\.\.|%2e" | head
What to do now
- Confirm whether you run ruoyi-vue-pro 2.4.1 or a fork based on it.
- Check the upstream repository for a newer release and read its change notes. The record does not confirm a fix.
- Require authentication for
/admin-api/infra/file/uploadand limit it to the clients that need it. - In your own code, resolve the final file path and reject any result outside the intended storage directory. Ignore client supplied directory names.
- Run the service under an account that can write only to the upload directory.
- Review files in and around the upload directory for anything unexpected.
Why it matters
The record lists CWE-22: path traversal, where a file path built from user input escapes the directory the programmer meant to use. Parent directory references in the input can lead to reading or writing files in other places.
The vector needs a low privilege account and scores impact as low for integrity and availability and none for confidentiality, giving 5.4. A write capable traversal can still matter when it lets someone place a file where the server will run it. The record says the exploit has been disclosed publicly. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
The fix pattern is well known: normalise the path, compare it to the base directory, and generate your own file names instead of trusting the client.
Quick check
Is there a fix for this ruoyi-vue-pro issue?
The record says the vendor did not respond, and names no fixed version. Check the repository and apply your own code fix if you maintain a copy.
Why two CVEs for one upload feature?
The record lists separate entries for the front end and back end interfaces. They use different endpoints, so check both.
Sources
Last reviewed: 19 October 2026.
