CVE-2025-65897 Details
Description
zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution.
A vulnerability in zdh_web, a data management platform, allows authenticated users to upload files to the server's file system. This issue arises from inadequate validation of file upload paths, enabling users to overwrite existing files. The vulnerability is present in zdh_web versions through 5.6.17 and could lead to privilege escalation or remote code execution.
Users are advised to upgrade to zdh_web version 5.6.18 or later, and to rebuild and redeploy their environments.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| zhaoyachao zdh web | <= 5.6.17 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Dec 5, 2025 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | New CVE Received | [email protected] |