CVE-2025-2490

Name of the Vulnerable Software and Affected Versions Dromara ujcms version 9.7.5

Description A problematic issue was found in the File Upload component, specifically in the uploadZip/upload function of the WebFileUploadController.java file. This issue leads to cross-site scripting and can be exploited remotely. The exploit has been publicly disclosed.

Recommendations For Dromara ujcms version 9.7.5, consider disabling the uploadZip/upload function of the WebFileUploadController.java file as a temporary workaround to minimize the risk of exploitation. Restrict access to the File Upload component to reduce the attack surface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.