CVE-2025-4533: JeecgBoot Document Library Upload zip unzipFile resource consumption

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-11 · updated 2026-06-17
Weakness: CWE-400

Description

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

JeecgBoot: through 3.8.0

References

https://github.com/jeecgboot/JeecgBoot/issues/8199
https://github.com/jeecgboot/JeecgBoot/issues/8199#issue-3022937633
https://github.com/jeecgboot/JeecgBoot/issues/8199#issuecomment-2834691016
https://vuldb.com/?ctiid.308278
https://vuldb.com/?id.308278
https://vuldb.com/?submit.566192

Get alerted when CVE-2025-4533 or the next vulnerability affects your stack