CVEvulnerability

CVE-2025-65897

8.8 HIGH Published 2025-12-05 Modified 2026-09-25 Official page ↗

Status: Analyzed
Published: 2025-12-05
Last modified: 2026-09-25
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-22, CWE-434

Description

zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution.

Affected configurations

• zhaoyachao zdh web (<= 5.6.17)

Weakness · CWE (2)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://github.com/zhaoyachao/zdh_web Product
https://github.com/zhaoyachao/zdh_web/commit/b2423378a8bf83f159f19ce4e14eac71c939793a Patch
https://github.com/zhaoyachao/zdh_web/issues/40 Issue Tracking, Vendor Advisory
https://github.com/zhaoyachao/zdh_web/pull/39 Patch

CVE-2025-65897

Description

Affected configurations

Related

Weakness · CWE (2)

References