CVE-2025-7487 | THREATINT

Description

A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Es wurde eine kritische Schwachstelle in JoeyBling SpringBoot_MyBatisPlus bis a6a825513bd688f717dbae3a196bc9c9622fea26 gefunden. Es geht dabei um die Funktion SysFileController der Datei /file/upload. Durch Manipulieren des Arguments portraitFile mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verfügbar.

Reserved 2025-07-11 | Published 2025-07-12 | Updated 2025-07-12 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Unrestricted Upload

Improper Access Controls

Product status

a6a825513bd688f717dbae3a196bc9c9622fea26

affected

Timeline

2025-07-11:	Advisory disclosed
2025-07-11:	VulDB entry created
2025-07-11:	VulDB entry last update

Credits

bi8bu (VulDB User) reporter

References

vuldb.com/?id.316137 (VDB-316137 | JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted upload) vdb-entry technical-description

vuldb.com/?ctiid.316137 (VDB-316137 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.609342 (Submit #609342 | JoeyBling SpringBoot_MyBatisPlus 2025/07/01 Unrestricted Upload) third-party-advisory

github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/19 exploit issue-tracking

cve.org (CVE-2025-7487)

nvd.nist.gov (CVE-2025-7487)

Download JSON