CVE-2025-6925 - CVE House
Back to Database
Status published Medium CVE-2025-6925

Dromara RuoYi-Vue-Plus Mail MailController.java path traversal

Vulnerability Description

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6925

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • ShenxiuSecurity (VulDB User)

References

More from Dromara

View All →
CVE-2025-7552
Dromara Northstar Path AuthorizationInterceptor.java preHandle access control
Medium 5.3
CVE-2025-6517
Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
Medium 5.3
CVE-2025-2491
Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
Medium 4.8
CVE-2025-2490
Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting
Medium 4.8
CVE-2025-15222
Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization
Low 2.3

Affected Vendor

Affected Software

RuoYi-Vue-Plus
Vulnerable Versions:
5.4.0

Timeline

Official Publish: June 30th, 2025
Last Modified: June 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact