CVE-2025-6761 Details
Description
A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor explains, that in the fixed release "Freemarker is set to 'ALLOWS_NOTHING_RESOLVER' to not parse any classes."
A critical remote code execution vulnerability has been identified in Kingdee Cloud-Starry-Sky Enterprise Edition versions 6.x, 7.x, 8.x, and 9.0. The issue arises in the Freemarker Engine component, specifically within the 'plugin.buildMobilePopHtml' function of the 'DynamicForm 4 Action.class' file. This vulnerability is due to improper neutralization of special elements in the template engine, allowing attackers to inject malicious code that is executed on the server. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and control over the affected system, potentially facilitating further intranet penetration attacks.
Users are advised to upgrade to a version of Kingdee Cloud-Starry-Sky that includes the patch for this vulnerability. The fixed version is available on the Kingdee Update platform. When applying the patch, ensure that the option to 'allow repeated executions' is selected.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 27, 2025CISA-ADP
Assessed Jun 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vip.kingdee.com/link/s/ZlWX7 | [email protected] | AdvisoryRemedyVendor |
| https://vip.kingdee.com/school/detail/713028702245944320 | [email protected] | Permission RequiredRemedyVendor |
| https://vuldb.com/?ctiid.314072 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.314072 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/?submit.601207 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-791 | Incomplete Filtering of Special Elements | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kingdee Cloud-Starry-Sky Enterprise Edition | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Jun 27, 2025 | New CVE Received | [email protected] |