CVE-2025-34040

Seeyon Zhiyuan OA System Path Traversal File Upload

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.

Affected

Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) · Zhiyuan OA Web Application System

CVSS v4.0 VULNCHECK

10.0 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

15.40% chance of exploitation in the next 30 days, 97th percentile

Nuclei

critical

Published

2025-06-24

Updated

2026-05-14

Proof-of-concept exploits (2)

• https://www.cnblogs.com/pursue-security/p/17677130.html
• jisi-001/CVE-2025-34040Exp2★ · 2025-08-29

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34040.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52490

Exploit collections (1)

• CVE-2025-34040.yamlzan8in/afrog

References

• CVE Record
• NVD entry

Related

• CVE-2024-48307
• CVE-2025-34300