CVE-2025-2040: zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-06 · updated 2026-06-17
Weakness: CWE-791

Description

A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

zhijiantianya ruoyi-vue-pro: 2.4.1

References

https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md
https://vuldb.com/?ctiid.298783
https://vuldb.com/?id.298783
https://vuldb.com/?submit.512574

Get alerted when CVE-2025-2040 or the next vulnerability affects your stack