Vulnerability · Published Mar 17, 2025 · Assigned by VulDB

CVE-2025-2363lenve VBlog ArticleController.java uploadImg path traversal

Medium 6.3

In plain English

A medium-severity path traversal in VBlog from lenve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/sang/controller/ArticleController.java. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
lenve	VBlog	1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-299862 | lenve VBlog ArticleController.java uploadImg path traversal vdb-entry, technical-description
VDB-299862 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #514721 | VBlog 1.0.0 Unrestricted Upload third-party-advisory
https://www.notion.so/Arbitrary-File-Upload-Vulnerability-in-VBlog-1-0-0-1adc693918ed8067b19ed9c61381024b exploit