CVE-2025-45855 Security Details

CVE ID

CVE-2025-45855

CWE

CWE-434

CVE Description

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.

Published

Jun 13, 2025

CVSS Score & Severity

5.1Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.384%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

xyz/erupt/core/controller/EruptFileController.upload(Ljava/lang/String;Ljava/lang/String;Lorg/springframework/web/multipart/MultipartFile;)Lxyz/erupt/core/view/EruptApiModel;

JVMVulnerable params: 2

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-5gr5-vmmr-82g6THIRD_PARTY