Vulnerability · Published Jan 24, 2025 · Assigned by VulDB

CVE-2025-0703JoeyBling bootplus SysFileController.java path traversal

Medium 4.3

In plain English

A medium-severity path traversal in bootplus from JoeyBling. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects some unknown processing of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Affected products (as reported)

Vendor	Product	Versions
JoeyBling	bootplus	247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-293231 | JoeyBling bootplus SysFileController.java path traversal vdb-entry, technical-description
VDB-293231 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #480842 | JoeyBling bootplus 1.0 any file download available third-party-advisory
https://github.com/JoeyBling/bootplus/issues/25 issue-tracking
https://github.com/JoeyBling/bootplus/issues/25#issue-2786928618 exploit, issue-tracking