CVE-2025-7487 - JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted upload

Back Back to CVE browser

MEDIUM

JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted upload

Published Jul 12, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Affected products

Vendor JoeyBling Product SpringBoot MyBatisPlus Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

JoeyBling

SpringBoot MyBatisPlus

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (4)

https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/19
exploitissue-tracking
https://vuldb.com/?ctiid.316137
signaturepermissions-required
https://vuldb.com/?id.316137
vdb-entrytechnical-description
https://vuldb.com/?submit.609342
third-party-advisory

Link	Providers	Tags
https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/19		exploitissue-tracking
https://vuldb.com/?ctiid.316137		signaturepermissions-required
https://vuldb.com/?id.316137		vdb-entrytechnical-description
https://vuldb.com/?submit.609342		third-party-advisory