CVE-2025-34040

🗓️ 24 Jun 2025 01:12:22Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 51 Views🌐 WEB

Arbitrary file upload vulnerability in Zhiyuan OA allows unauthenticated remote code execution.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-34040	24 Jun 202501:46	–	circl
CNNVD	Seeyon Zhiyuan OA 安全漏洞	24 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-34040 Seeyon Zhiyuan OA System Path Traversal File Upload	24 Jun 202501:12	–	cvelist
Exploit DB	Zhiyuan OA - arbitrary file upload leading	6 Apr 202600:00	–	exploitdb
EUVD	EUVD-2025-19043	3 Oct 202520:07	–	euvd
GithubExploit	Exploit for CVE-2025-34040	29 Aug 202507:33	–	githubexploit
Nuclei	Zhiyuan OA Platform - Arbitrary File Upload	22 Jun 202605:20	–	nuclei
NVD	CVE-2025-34040	24 Jun 202502:15	–	nvd
Packet Storm	📄 Zhiyuan OA Traversal / File Upload	6 Apr 202600:00	–	packetstorm
Positive Technologies	PT-2025-26671	24 Jun 202500:00	–	ptsecurity

Vulners

Node

seeyon zhiyuan_oa_web_application_systemMatch5.0

seeyon zhiyuan_oa_web_application_systemRange5.1–5.6sp1

seeyon zhiyuan_oa_web_application_systemRange6.0–6.1sp2

seeyon zhiyuan_oa_web_application_systemMatch7.0

seeyon zhiyuan_oa_web_application_systemRange7.0sp1–7.1

seeyon zhiyuan_oa_web_application_systemMatch7.1sp1

seeyon zhiyuan_oa_web_application_systemRange8.0–8.0sp2

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "wpsAssistServlet File Upload Handler"
    ],
    "product": "Zhiyuan OA Web Application System",
    "vendor": "Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.)",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "5.6sp1",
        "status": "affected",
        "version": "5.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.1sp2",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "7.1",
        "status": "affected",
        "version": "7.0sp1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1sp1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "8.0sp2",
        "status": "affected",
        "version": "8.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
service	www.service.seeyon.com/patchtools/tp.html
cnblogs	www.cnblogs.com/pursue-security/p/17677130.html
cnvd	www.cnvd.org.cn/flaw/show/CNVD-2021-01627
vulncheck	www.vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
exploit-db	www.exploit-db.com/exploits/52490

Parameter	Position	Path	Description	CWE
realFileType	query param	seeyon/wpsAssistServlet	Path traversal during multipart file upload allowing arbitrary file writes outside intended directories via realFileType/fileId parameters.	CWE-22, CWE-434
fileId	query param	seeyon/wpsAssistServlet	Path traversal during multipart file upload allowing arbitrary file writes outside intended directories via realFileType/fileId parameters.	CWE-22, CWE-434

17 Jun 2026 09:13Current

7.8High risk

Vulners AI Score7.8

CVSS 410

EPSS0.10212

SSVC

In Wild

cve-2025-34040 zhiyuan oa system path traversal file upload remote code execution