BaseFortify

Publication date: 2025-10-28

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-28

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-10-28

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12344

EUVD

EUVD-2025-36388

Affected Vendors & Products

Vendor	Product	Version / Range
yonyou	u8_cloud	2.0
yonyou	u8_cloud	5.1sp

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Yonyou U8 Cloud up to version 5.1sp, specifically in an unknown function within the /service/NCloudGatewayServlet file of the Request Header Handler component. It involves manipulation of the argument ts/sign, which leads to unrestricted upload capabilities. This means an attacker can upload files without proper restrictions, potentially from a remote location. The vulnerability has been publicly disclosed and can be exploited.

Impact Analysis

The vulnerability allows an attacker to perform unrestricted uploads remotely, which could lead to unauthorized files being uploaded to the system. This can result in potential compromise of the system's integrity, unauthorized access, or further exploitation depending on what files are uploaded and how they are used.

Hi! I’m here to help you understand CVE-2025-12344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70