What is CVE-2025-7487?

CVE-2025-7487 is a medium-severity vulnerability in Joeybling Springboot Mybatisplus, classified under Improper Access Control. CVSS score: 6.3/10. Published 2025-07-12.

How severe is CVE-2025-7487?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Arbitrary file upload in Joeybling Springboot Mybatisplus

CVE-2025-7487

A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

EPSS: 0.002 (15.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Joeybling Springboot_mybatisplus — versions a6a825513bd688f717dbae3a196bc9c9622fea26

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking, exploit)

Frequently asked questions

What is CVE-2025-7487?: CVE-2025-7487 is a medium-severity vulnerability in Joeybling Springboot Mybatisplus, classified under Improper Access Control. CVSS score: 6.3/10. Published 2025-07-12.
How severe is CVE-2025-7487?: Medium severity. CVSS v3 base score is 6.3 out of 10.