CVE-2025-4529CWE-22

Seeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversal

Medium · published May 11, 2025

CVSS v4.0
5.3
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\WEB-INF\lib\seeyon-apps-m3.jar!\com\seeyon\apps\m3\core\controller\M3CoreController.class of the component ZIP File Handler. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-05-11T04:00Z
EPSS history
Timeline
  • 11 MAY 04:00Z
    Seeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversal
    cvelistv5