Vulnerability · Published Jan 12, 2025 · Assigned by VulDB
CVE-2025-04011902756969 reggie CommonController.java download path traversal
Medium 5.3
In plain English
A medium-severity path traversal in reggie from 1902756969. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 1902756969 | reggie | 1.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- VDB-291276 | 1902756969 reggie CommonController.java download path traversal vdb-entry, technical-description
- VDB-291276 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #473322 | 1902756969 reggie 1.0 Read any file third-party-advisory
- https://github.com/1902756969/reggie/issues/1 issue-tracking
- https://github.com/1902756969/reggie/issues/1#issue-2765577260 exploit, issue-tracking