zhuimengshaonian wisdom-education CVE-2025-11320

Q: What is the CVSS score of CVE-2025-11320?

CVE-2025-11320 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-10-06 cna@vuldb.com

Java Authentication Bypass File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:00 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Unrestricted file upload in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to upload arbitrary files via the uploadFile function in UploadController.java, potentially enabling remote code execution or system compromise. The vulnerability has publicly disclosed exploit code available. Despite a low CVSS score of 2.1 reflecting limited direct impact scope, the presence of public exploits and authentication bypass tags suggests practical exploitation risk in environments where attacker access is feasible.

Technical ContextAI

The vulnerability resides in the uploadFile endpoint of the UploadController.java file in the wisdom-education web application, a Java-based educational platform. The root cause is classified as CWE-284 (Improper Access Control), indicating insufficient validation or authorization checks on file upload operations. The affected component fails to properly restrict the types, sizes, or destinations of uploaded files, allowing an authenticated user to manipulate the File argument and bypass intended upload restrictions. The Java servlet-based file upload handler does not implement adequate content-type validation, filename sanitization, or storage path restrictions.

Affected ProductsAI

zhuimengshaonian wisdom-education versions up to and including 1.0.4. The UploadController.java file in src/main/java/com/education/core/controller/ is the specific affected component. No CPE string was provided in the source data.

RemediationAI

Immediately upgrade zhuimengshaonian wisdom-education to a patched version beyond 1.0.4; consult the vendor's security advisory for the exact fixed version number as it was not provided in available data. Interim compensating controls include: (1) disable or restrict access to the /uploadFile endpoint via reverse proxy or firewall rules, allowing uploads only from trusted administrative subnets - this prevents opportunistic exploitation but limits functionality; (2) implement strict whitelist validation for uploaded file extensions (e.g., only .pdf, .jpg, .png) and reject all others, with file type verification via magic bytes rather than extension; (3) store uploaded files outside the web root in a non-executable directory with restricted permissions (chmod 644 or similar) so even if malicious files are uploaded, they cannot be directly executed; (4) enable detailed audit logging of all upload attempts including username, file name, file size, and timestamp to detect abuse patterns. Reference the public vulnerability disclosure at https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md for technical details.