cve-2025-34040
CRITICAL CVSS 10.0 opencve
Description
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Timeline
- Published
- 2025-06-24 02:15 UTC
- Last Modified
- 2026-06-17
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 4.0 | 10.0 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
mitre | ||
| 4.0 | 10.0 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
nvd | ||
| 4.0 | 10.0 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
opencve |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"advisories": [
{
"id": "EUVD-2025-19043",
"source": "euvd",
"title": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.",
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19043"
}
],
"cve": "CVE-2025-34040",
"epss": {
"score": 0.15109
},
"mitre": {
"cpes": [],
"created": "2025-06-24T01:12:22.769000+00:00",
"description": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {
"score": 10,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
},
"mitre_repo_path": "cves/2025/34xxx/CVE-2025-34040.json",
"references": [
"https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1",
"https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload",
"https://www.cnblogs.com/pursue-security/p/17677130.html",
"https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627"
],
"title": "Seeyon Zhiyuan OA System Path Traversal File Upload",
"updated": "2026-05-14T02:07:28.184000+00:00",
"vendors": [],
"weaknesses": [
"CWE-22",
"CWE-434"
]
},
"nvd": {
"cpes": [],
"created": "2025-06-24T02:15:22.673000+00:00",
"description": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {
"score": 10.0,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
},
"nvd_repo_path": "2025/CVE-2025-34040.json",
"references": [
"https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1",
"https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload",
"https://www.cnblogs.com/pursue-security/p/17677130.html",
"https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627",
"https://www.exploit-db.com/exploits/52490"
],
"title": null,
"updated": "2026-06-17T09:13:21.587000+00:00",
"vendors": [],
"weaknesses": [
"CWE-22",
"CWE-434"
]
},
"opencve": {
"changes": [
{
"created": "2025-06-24T01:45:00+00:00",
"data": [
{
"details": {
"new": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.",
"old": null
},
"type": "description"
},
{
"details": {
"new": "Zhiyuan OA System Path Traversal File Upload",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-22",
"CWE-434"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": [
"https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1",
"https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload",
"https://www.cnblogs.com/pursue-security/p/17677130.html",
"https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV4_0": {
"score": 10,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "4f2db5ee-f7fa-4a3e-a8ee-735e5c955d52"
},
{
"created": "2025-06-24T16:15:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "poc",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "01568bda-fda6-4c0c-8b44-1397ff5faef1"
},
{
"created": "2025-07-11T13:45:00+00:00",
"data": [
{
"details": {
"added": {},
"removed": {},
"updated": {
"epss": {
"new": {
"score": 0.04765
},
"old": {
"score": 0.00537
}
}
}
},
"type": "metrics"
}
],
"id": "b51cccbe-1baf-4beb-acd6-e02a46f7a176"
},
{
"created": "2025-07-16T13:45:00+00:00",
"data": [
{
"details": {
"added": {},
"removed": {},
"updated": {
"epss": {
"new": {
"score": 0.0434
},
"old": {
"score": 0.04765
}
}
}
},
"type": "metrics"
}
],
"id": "b1aa345c-fe22-4b85-8b22-35e7178f5a62"
},
{
"created": "2025-10-30T20:00:00+00:00",
"data": [
{
"details": {
"new": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.",
"old": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server."
},
"type": "description"
},
{
"details": {
"new": "Seeyon Zhiyuan OA System Path Traversal File Upload",
"old": "Zhiyuan OA System Path Traversal File Upload"
},
"type": "title"
}
],
"id": "9b227f1d-7bab-4ae5-b3c5-d41f1c9511ca"
},
{
"created": "2025-11-17T21:45:00+00:00",
"data": [
{
"details": {
"new": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-05 UTC.",
"old": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server."
},
"type": "description"
}
],
"id": "9f29dc3e-a46a-482c-ae43-a6e16dabae45"
},
{
"created": "2025-11-20T21:15:00+00:00",
"data": [
{
"details": {
"new": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",
"old": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-05 UTC."
},
"type": "description"
}
],
"id": "d5893f7f-a2fe-479d-9a38-319c522c4aeb"
},
{
"created": "2026-04-29T20:30:00+00:00",
"data": [
{
"details": {
"added": [
"https://www.exploit-db.com/exploits/52490"
],
"removed": []
},
"type": "references"
}
],
"id": "2278a954-9279-497c-af51-5492b40351e5"
}
],
"cpes": {
"data": [],
"providers": []
},
"created": {
"data": "2025-06-24T01:12:22.769000+00:00",
"provider": "mitre"
},
"description": {
"data": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {},
"provider": null
},
"cvssV4_0": {
"data": {
"score": 10,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
},
"provider": "mitre"
},
"epss": {
"data": {
"score": 0.15109
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "yes",
"Exploitation": "poc",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1",
"https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload",
"https://www.cnblogs.com/pursue-security/p/17677130.html",
"https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627",
"https://www.exploit-db.com/exploits/52490"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "Seeyon Zhiyuan OA System Path Traversal File Upload",
"provider": "mitre"
},
"updated": {
"data": "2026-04-29T20:16:28.320000+00:00",
"provider": "nvd"
},
"vendors": {
"data": [],
"providers": []
},
"weaknesses": {
"data": [
"CWE-22",
"CWE-434"
],
"providers": [
"mitre",
"nvd"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2025-06-24T01:12:22.769000+00:00",
"description": "An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "poc",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": "Seeyon Zhiyuan OA System Path Traversal File Upload",
"updated": "2025-06-24T15:43:47.860000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2025/34xxx/CVE-2025-34040.json",
"weaknesses": []
}
}
Enrichment data
Aggregated bundle (all enrichments)