Vulnerability · Published Mar 6, 2025 · Assigned by VulDB
CVE-2025-2040zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine
Medium 6.3
In plain English
A medium-severity security flaw in ruoyi-vue-pro from zhijiantianya. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zhijiantianya | ruoyi-vue-pro | 2.4.1 |
Weakness: CWE-1336, CWE-791 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-298783 | zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine vdb-entry
- VDB-298783 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #512574 | https://gitee.com/zhijiantianya/ruoyi-vue-pro ruoyi-vue-pro 2.4.1 SSTI third-party-advisory
- https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md exploit