Medium severity · published Jul 20, 2025
CVE-2025-7906
yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RuoYi · yangzongzhuan
4.8.0; 4.8.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7906
Exploit
https://github.com/yangzongzhuan/RuoYi/issues/296
Permissions Required
https://vuldb.com/?ctiid.317021
Third Party Advisory
https://vuldb.com/?id.317021
Third Party Advisory
https://vuldb.com/?submit.618361
More from RuoYi
9.8
CVE-2025-10473
yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection
8.8
CVE-2025-10989
yangzongzhuan RuoYi selectAll improper authorization
6.1
CVE-2025-7901
yangzongzhuan RuoYi Swagger UI index.html cross site scripting
5.4
CVE-2025-10384
yangzongzhuan RuoYi Role cancelAll improper authorization
5.4
CVE-2025-8847
yangzongzhuan RuoYi edit cross site scripting