CVE-2025-9409 : faille moyenne lostvip ruoyi-go (CVSS 6.5)

A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Sévérité

Moyenne (CVSS 6.5)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitation active

Non signalée par la CISA

Publication

25 août 2025

Dernière mise à jour

17 juin 2026

• lostvip ruoyi-go

• Fiche CVE-2025-9409 sur le NVD (NIST)
• github.com/on-theway/cve/issues/1
• github.com/on-theway/cve/issues/2
• vuldb.com/
• vuldb.com/
• vuldb.com/
• vuldb.com/