CVE-2025-4893

CVE-2025-4893 is a critical path traversal vulnerability found in the uploadLocalImage function within the File Upload Endpoint of jammy928 CoinExchange_CryptoExchange_Java, specifically affecting versions up to commit 8adf508b996020d3efbeeb2473d7235bd01436fa. This flaw allows an authenticated attacker to manipulate the filename argument, potentially leading to unauthorized file access, modification, or creation on the server. The vulnerability has a CVSS score of 6.3 (Medium), indicating a network-based attack with low complexity, requiring low privileges, and resulting in low impact to confidentiality, integrity, and availability. While the exploit has been publicly disclosed, there is currently no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules available. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities. Despite the public disclosure, the low EPSS score suggests a low probability of exploitation in the wild.