CVE-2025-2363: lenve VBlog ArticleController.java uploadImg path traversal

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-17 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/sang/controller/ArticleController.java. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

lenve VBlog: all versions

References

https://vuldb.com/?ctiid.299862
https://vuldb.com/?id.299862
https://vuldb.com/?submit.514721
https://www.notion.so/Arbitrary-File-Upload-Vulnerability-in-VBlog-1-0-0-1adc693918ed8067b19ed9c61381024b

Get alerted when CVE-2025-2363 or the next vulnerability affects your stack