Which versions of Zhiyuan OA are affected by CVE-2025-34040?

CVE-2025-34040 presents critical security risk, a path traversal vulnerability rated CVSS 10.0.

Is there a public PoC exploit available for CVE-2025-34040?

Yes, a public proof-of-concept exploit is available for CVE-2025-34040. Prioritise patching immediately. EPSS: 3.8%.

How to fix or mitigate CVE-2025-34040?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Review file handling controls and restrict upload directories.

Zhiyuan OA CVE-2025-34040

Q: What is the CVSS score of CVE-2025-34040?

CVE-2025-34040 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.8%.

EUVD-2025-19043 CRITICAL

Path Traversal (CWE-22)

2025-06-24 disclosure@vulncheck.com

RCE Path Traversal File Upload

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network attack vector, low complexity, no privileges, no user interaction, scope changed, high CIA.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-19043

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

PoC Detected

Nov 20, 2025 - 21:16 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 02:15 nvd

CRITICAL 10.0

DescriptionCVE.org

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.

AnalysisAI

Remote code execution in Zhiyuan OA platform via arbitrary file upload. Unauthenticated attackers can upload crafted JSP files through the wpsAssistServlet interface using path traversal, leading to full server compromise. Public exploit code exists and exploitation has been observed in the wild.

Technical ContextAI

The vulnerability resides in the wpsAssistServlet interface of Zhiyuan OA, a web-based office automation platform. It involves improper validation of the realFileType and fileId parameters during multipart file uploads, allowing path traversal (CWE-22). Attackers can upload files outside intended directories, enabling execution of JSP files via the web server. Affected versions span multiple major releases including 5.x, 6.x, 7.x, and 8.x as per EUVD data.

RemediationAI

Apply the vendor-released patch from Seeyon (Zhiyuan) via the patch management page: https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1. As a workaround, restrict access to the wpsAssistServlet interface via web server rules or firewall, or disable the WPS integration feature if not required. Note that blocking the endpoint may impact legitimate WPS functionality.