Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2025-34040: Zhiyuan OA Platform Allows Malicious File Uploads
CVE-2025-34040 · published 1 year ago
Summary
The Zhiyuan OA platform has a security issue that lets attackers upload any type of file without being logged in. This could allow a hacker to upload a malicious file that can take control of the server. If you use this platform, check to see if the issue has been fixed and take steps to protect your system.
Original advisory text
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file up...
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-22Path Traversal
CWE-434Unrestricted File Upload
Timeline
Published24 Jun 2025
Updated15 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-34040 · NVD
Track software like this
Free during beta