by Kastro
Paper/Archive/CVE-2025-3381

CVE-2025-3381

zhangyanbo2007 youkefu — zhangyanbo2007 youkefu File Upload WebIMController.java path traversal

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.4.664 × 2013.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of the component File Upload. The manipulation of the argument ID leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
youkefu4.2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.303627refvuldb.com/?ctiid.303627writeupvuldb.com/?submit.552369exploitgithub.com/mapl3miss/uckefuVul/blob/main/uckefu-upload.md