CVE-2025-12344 Details
Description
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A critical vulnerability allowing unrestricted file upload has been identified in Yonyou U8 Cloud versions through 5.1sp. The issue arises in the Request Header Handler component, specifically within the NCloudGatewayServlet service. By manipulating the 'ts' and 'sign' headers, attackers can bypass security checks and upload executable files to the server.
It is recommended not to hard-code encryption keys, to restrict allowed file types for uploads, and to limit upload directories to prevent unauthorized file execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2025CISA-ADP
Assessed Oct 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/IceSc0rpion/CVE/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/?ctiid.330129 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?id.330129 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.674532 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yonyou U8 Cloud | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Oct 28, 2025 | New CVE Received | [email protected] |