Description

A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnerability is the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file fileUpload/deleteFileAction.jhtml of the component File Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. In Kingdee Cloud Galaxy Private Cloud BBC System bis 9.0 Patch April 2025 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion BaseServiceFactory.getFileUploadService.deleteFileAction der Datei fileUpload/deleteFileAction.jhtml der Komponente File Handler. Durch Beeinflussen des Arguments filePath mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme wird Patching empfohlen.

Classification

CVE ID: CVE-2025-5029

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.4

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected Products

Vendor: Kingdee

Product: Cloud Galaxy Private Cloud BBC System

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.06% (probability of being exploited)

EPSS Percentile: 18.01% (scored less or equal to compared to others)

EPSS Date: 2025-06-19 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-5029
https://vuldb.com/?id.309847
https://vuldb.com/?ctiid.309847
https://vuldb.com/?submit.570956
https://wx.mail.qq.com/s?k=nFbp0U0gSX0QVechIO
https://vip.kingdee.com/knowledge/708656434111770368
https://vip.kingdee.com/school/detail/713028702245944320?productLineId=1&lang=zh-CN

Timeline