CVE-2025-4533

JeecgBoot Document Library Upload zip unzipFile resource consumption

State: Published
Severity: 5.1 Medium
Published: May 11, 2025
Updated: May 12, 2025
Reserved: May 10, 2025

Description

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	VulDB
3.0	2.7 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:N/A:P	VulDB

Weaknesses

CWE-400 Resource Consumption
CWE-404 Denial of Service

Affected Products

Product	Versions
JeecgBootn/a	3.0Affected 3.1Affected 3.2Affected 3.3Affected 3.4Affected 3.5Affected 3.6Affected 3.7Affected 3.8.0Affected

References

VDB-308278 | JeecgBoot Document Library Upload zip unzipFile resource consumptionvdb-entrytechnical-description
VDB-308278 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #566192 | guojusoft JeecgBoot v3.8.0 Resource Consumptionthird-party-advisory
https://github.com/jeecgboot/JeecgBoot/issues/8199issue-tracking
https://github.com/jeecgboot/JeecgBoot/issues/8199#issuecomment-2834691016issue-tracking
https://github.com/jeecgboot/JeecgBoot/issues/8199#issue-3022937633exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.