CVE-2025-2490 Overview
CVE-2025-2490 is a cross-site scripting (XSS) vulnerability in Dromara ujcms version 9.7.5, a Java-based content management system. The flaw resides in the uploadZip/upload function within /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java, part of the File Upload component. Attackers can manipulate upload parameters to inject script content that executes in the context of other users' browsers. The vulnerability is remotely exploitable and requires authenticated access with high privileges plus user interaction. Public disclosure of the exploit technique increases the likelihood of opportunistic abuse against unpatched deployments.
Critical Impact
Authenticated attackers can inject persistent script payloads through the file upload workflow, enabling session hijacking, credential theft, and administrative account compromise within the ujcms backend.
Affected Products
- Dromara ujcms 9.7.5
- ujcms File Upload component (WebFileUploadController.java)
- Backend API endpoint uploadZip/upload
Discovery Timeline
- 2025-03-18 - CVE-2025-2490 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2490
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw [CWE-79] affecting the ujcms backend file upload handler. The uploadZip/upload function in WebFileUploadController.java fails to sanitize user-controlled input before returning it in server responses or rendering it in the administrative interface. When an authenticated user uploads a crafted archive or manipulates upload metadata, script content is preserved and later executed in the browser of any user who views the affected resource. Exploitation requires the attacker to already possess high-privilege credentials and requires a victim to interact with the tainted content. The impact scope is limited to integrity within the vulnerable component, with no direct effect on confidentiality or availability.
Root Cause
The root cause is improper neutralization of input during web page generation within the file upload controller. The application accepts filenames or archive contents from the client without applying output encoding or allow-list validation. This omission permits HTML and JavaScript payloads to reach the DOM of downstream viewers.
Attack Vector
An authenticated attacker with backend administrative privileges submits a request to the uploadZip/upload endpoint containing script payloads embedded in upload parameters or file metadata. When another backend user browses the file listing or previews the uploaded content, the injected script executes in that user's session context. Refer to the ujcms GitHub Issue #12 and ujcms GitHub Issue #13 for the original disclosures. Because no verified proof-of-concept code has been published to a coordinated repository, defenders should treat the VulDB entry #299996 as the authoritative technical reference.
Detection Methods for CVE-2025-2490
Indicators of Compromise
- HTTP POST requests to /uploadZip/upload containing HTML tags, <script> elements, or JavaScript event handlers in filenames or form fields.
- Uploaded archive entries whose names include angle brackets, javascript: URIs, or encoded script fragments.
- Unexpected outbound requests from administrator browsers immediately after viewing the ujcms file management interface.
- Session tokens or authentication cookies appearing in web server logs of attacker-controlled domains referenced by ujcms pages.
Detection Strategies
- Inspect web server and application logs for upload requests where parameter values contain script syntax, HTML entities, or unusual Unicode escapes.
- Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from the ujcms backend.
- Implement web application firewall (WAF) rules that flag XSS payload patterns on the file upload endpoint.
Monitoring Recommendations
- Monitor administrative account activity within ujcms, focusing on file upload operations performed outside normal business hours.
- Alert on new or modified files in the ujcms upload directory whose names contain non-standard characters.
- Track browser telemetry from privileged users for anomalous script execution within the CMS administrative domain.
How to Mitigate CVE-2025-2490
Immediate Actions Required
- Restrict access to the ujcms backend administrative interface to trusted networks using firewall or reverse proxy rules.
- Audit accounts with upload privileges and revoke access for users who do not require it.
- Enforce a strict Content Security Policy on the CMS backend to prevent execution of inline and untrusted scripts.
- Review recent upload activity in ujcms 9.7.5 for filenames or archive contents containing HTML or JavaScript.
Patch Information
At the time of last NVD update, no fixed release has been referenced in the CVE record. Track the vendor's response through the ujcms GitHub Issue #12 and ujcms GitHub Issue #13 threads. Apply any subsequent patch published by Dromara to WebFileUploadController.java as soon as it becomes available.
Workarounds
- Disable the uploadZip/upload functionality if it is not required for business operations.
- Place a reverse proxy or WAF in front of ujcms to strip HTML and script content from upload parameters and filenames.
- Require multi-factor authentication for all backend administrator accounts to reduce the value of hijacked sessions.
- Serve uploaded content from a separate, sandboxed origin so that injected scripts cannot access administrative session cookies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
