Erupt Unrestricted Upload of File with Dangerous Type vulnerability

中危 5.4CVE-2025-45855 · GHSA-5gr5-vmmr-82g6 · Published 03/06/2025 · updated 17/06/2026

要点

CVE-2025-45855 是影响 xyz.erupt:erupt, erupt (erupt) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.36%，高于 30.3% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
xyz.erupt:erupt Maven	`≤ 1.12.19`	No fix yet
erupt erupt	`≤ 1.12.19`	No fix yet

Description

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.

NVD description

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.

References

nvd.nist.gov/vuln/detail/CVE-2025-45855 · ADVISORY
gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06 · WEB
erupts/erupt · PACKAGE
erupt.xyz · WEB
erupt.xyz · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free