Cyber Resilience

CVE-2025-6925

MediumPublic PoC

Published: 30 June 2025

Published
30 June 2025
Modified
16 September 2025
KEV Added
—
Patch
—
CVSS Score v4 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0143 81.0th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6925 is a medium-severity Path Traversal (CWE-22) vulnerability in Dromara Ruoyi-Vue-Plus. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 19.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A path traversal vulnerability tracked as CVE-2025-6925 affects Dromara RuoYi-Vue-Plus version 5.4.0. The flaw resides in the Mail Handler component within the file /src/main/java/org/dromara/demo/controller/MailController.java, where unsanitized input to the filePath argument enables directory traversal. It is assigned CWE-22 and carries a CVSS 4.0 score of 5.5 reflecting network-accessible, low-complexity exploitation that impacts confidentiality only.

Remote, unauthenticated attackers can supply crafted filePath values to read arbitrary files on the server. Public proof-of-concept code has been released demonstrating the issue, and the vendor was notified but provided no response or patch.

The associated EPSS score remains flat at 0.0143 with no observed increase after disclosure. Available references consist of a public GitHub repository containing reproduction steps and VulDB entries; no official mitigation guidance or patched releases are documented.

EU & UK References

Vulnerability details

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal.…

more

The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal in MailController enables arbitrary file reads from the local system (T1005, T1006) via exploitation of a public-facing web application without authentication (T1190).

Affected Assets

dromara
ruoyi-vue-plus
5.4.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References