CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-4893: jammy928 CoinExchange_CryptoExchange_Java File Upload Endpoint UploadFileUtil.java uploadLocalImage path traversal

6.3 CVSS

Description

A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects the function uploadLocalImage of the file /CoinExchange_CryptoExchange_Java-master/00_framework/core/src/main/java/com/bizzan/bitrade/util/UploadFileUtil.java of the component File Upload Endpoint. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Es wurde eine Schwachstelle in jammy928 CoinExchange_CryptoExchange_Java bis 8adf508b996020d3efbeeb2473d7235bd01436fa entdeckt. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion uploadLocalImage der Datei /CoinExchange_CryptoExchange_Java-master/00_framework/core/src/main/java/com/bizzan/bitrade/util/UploadFileUtil.java der Komponente File Upload Endpoint. Mittels Manipulieren des Arguments filename mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verfügbar.

Classification

CVE ID: CVE-2025-4893

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Problem Types

Path Traversal

Affected Products

Vendor: jammy928

Product: CoinExchange_CryptoExchange_Java

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.06% (probability of being exploited)

EPSS Percentile: 17.55% (scored less or equal to compared to others)

EPSS Date: 2025-06-16 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4893
https://vuldb.com/?id.309447
https://vuldb.com/?ctiid.309447
https://vuldb.com/?submit.577907
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250515-01.md

Timeline