Which versions of SpringBoot_MyBatisPlus are affected by CVE-2025-7488?

Organizations using JoeyBling SpringBoot_MyBatisPlus should be aware of moderate risk from CVE-2025-7488, a path traversal vulnerability rated CVSS 4.3. This could allow unauthorized file access.

How to fix or mitigate CVE-2025-7488?

Within 30 days: Identify affected systems running JoeyBling SpringBoot_MyBatisPlus and apply vendor patches as part of regular patch cycle. Review file handling controls.

SpringBoot_MyBatisPlus CVE-2025-7488

Q: What is the CVSS score of CVE-2025-7488?

CVE-2025-7488 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21233 LOW

Path Traversal (CWE-22)

2025-07-12 cna@vuldb.com

Path Traversal

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Requires low privileges, no user interaction, low confidentiality impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21233

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

CVE Published

Jul 12, 2025 - 20:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

AnalysisAI

Path traversal vulnerability in SpringBoot_MyBatisPlus up to commit a6a8255 allows remote authenticated attackers to read arbitrary files via the Name parameter in the /file/download endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.05%), indicating low exploitation likelihood.

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in the Download function of the /file/download endpoint. The application is a Spring Boot project integrating MyBatis-Plus, a popular ORM framework for Java. The affected component is the file download functionality, which fails to sanitize user-supplied input for the Name parameter, allowing directory traversal sequences (e.g., ../) to access files outside the intended directory. The CPE data is not provided, but the affected version is identified by a specific Git commit hash (a6a8255), indicating a rolling release model without version numbers.

RemediationAI

No official patched version is available due to the rolling release model. Users should apply the fix from the upstream commit if available, or manually sanitize the Name parameter in the /file/download endpoint to prevent path traversal (e.g., reject inputs containing '../' or use a whitelist of allowed files). As a workaround, restrict access to the /file/download endpoint to trusted users only, or disable the endpoint if not needed. Monitor the GitHub issue for updates: https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/18