CVE-2025-56815
HIGH 7.1EPSS 0.6%
Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.
- CVSS v3.1
- 7.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - EPSS
- 0.62% chance of exploitation in the next 30 days, 48th percentile
- Published
- 2025-09-24
Proof-of-concept exploits (1)
- xiaoxiaoranxxx/CVE-2025-568155★ · 2025-09-24