Log in Start free

Vulnerability · Published Sep 1, 2025 · Assigned by VulDB

CVE-2025-9795xujeff tianti 天梯 UploadController.java ajaxUploadFile unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in tianti 天梯 from xujeff. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

VendorProductVersions
xujeff tianti 天梯 2.02.12.22.3

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References