CVE-2025-3381: zhangyanbo2007 youkefu File Upload WebIMController.java path traversal

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-07 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of the component File Upload. The manipulation of the argument ID leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

zhangyanbo2007 youkefu: 4.2.0

References

https://github.com/mapl3miss/uckefuVul/blob/main/uckefu-upload.md
https://vuldb.com/?ctiid.303627
https://vuldb.com/?id.303627
https://vuldb.com/?submit.552369
https://github.com/mapl3miss/uckefuVul/blob/main/uckefu-upload.md

Get alerted when CVE-2025-3381 or the next vulnerability affects your stack