CVE-2025-4868
merikbest ecommerce-spring-reactjs File Upload Endpoint admin path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 18, 2025
- Updated
- May 19, 2025
- Reserved
- May 16, 2025
Description
A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v1/admin/ of the component File Upload Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
ecommerce-spring-reactjsmerikbest |
|
References
- VDB-309410 | merikbest ecommerce-spring-reactjs File Upload Endpoint admin path traversalvdb-entrytechnical-description
- VDB-309410 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #575506 | merikbest ecommerce-spring-reactjs master branch Path Traversalthird-party-advisory
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250512-01.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.