Vulnerability details
CVE-2025-34040
Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) Zhiyuan OA Web Application System
Seeyon Zhiyuan OA System Path Traversal File Upload
CVSS 4.0
10.0Critical
Official description
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 5.0 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 7.0 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 7.1sp1 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 5.1 ≤ v ≤ 5.6sp1 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 6.0 ≤ v ≤ 6.1sp2 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 7.0sp1 ≤ v ≤ 7.1 | CVEProject cvelistV5 (CNA) |
| Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) | Zhiyuan OA Web Application System | 8.0 ≤ v ≤ 8.0sp2 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1 vendor-advisorypatch
- https://www.cnblogs.com/pursue-security/p/17677130.html exploittechnical-description
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627 third-party-advisory
- https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload third-party-advisory
- https://www.exploit-db.com/exploits/52490
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-06-24
- Last updated
- 2026-05-14
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
15.4%
Probability of exploitation in 30 days
96.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')