CVE-2025-65897

zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zhaoyachao/zdh_web	Product
https://github.com/zhaoyachao/zdh_web/commit/b2423378a8bf83f159f19ce4e14eac71c939793a	Patch
https://github.com/zhaoyachao/zdh_web/issues/40	Issue Tracking Vendor Advisory
https://github.com/zhaoyachao/zdh_web/pull/39	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:zhaoyachao:zdh_web:*:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) zdh_web es una plataforma de recopilación, procesamiento, monitoreo, programación y gestión de datos. En zdh_web hasta la versión 5.6.17, la validación insuficiente de las rutas de carga de archivos en la aplicación permite a un usuario autenticado escribir archivos arbitrarios en el sistema de archivos del servidor, lo que podría sobrescribir archivos existentes y conducir a una escalada de privilegios o ejecución remota de código.

Information

Published : 2025-12-05 16:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-65897

Mitre link : CVE-2025-65897

CVE.ORG link : CVE-2025-65897

JSON object : View

Products Affected

zhaoyachao

zdh_web

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2025-65897", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65897", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T20:47:30.450639Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-05T16:15:50.913", "references": [{"url": "https://github.com/zhaoyachao/zdh_web", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/zhaoyachao/zdh_web/commit/b2423378a8bf83f159f19ce4e14eac71c939793a", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/zhaoyachao/zdh_web/issues/40", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zhaoyachao/zdh_web/pull/39", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution."}, {"lang": "es", "value": "zdh_web es una plataforma de recopilaci\u00f3n, procesamiento, monitoreo, programaci\u00f3n y gesti\u00f3n de datos. En zdh_web hasta la versi\u00f3n 5.6.17, la validaci\u00f3n insuficiente de las rutas de carga de archivos en la aplicaci\u00f3n permite a un usuario autenticado escribir archivos arbitrarios en el sistema de archivos del servidor, lo que podr\u00eda sobrescribir archivos existentes y conducir a una escalada de privilegios o ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zhaoyachao:zdh_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1C57E92-1507-4906-807A-8341427AAAE9", "versionEndIncluding": "5.6.17"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}