CVE-2025-8516

Vulnerability

A path traversal vulnerability has been identified in Kingdee Cloud-Starry-Sky Enterprise Edition up to version 8.2. The flaw resides in the FileUploadAction.class within the Kingdee.K3.O2O.Base.WebApp.jar file. Specifically, the deleteFileAction function of the BaseServiceFactory.getFileUploadService service does not properly sanitize the filePath parameter, allowing an attacker to traverse directories outside the intended scope [1].

Exploitation

This vulnerability can be exploited remotely without authentication, as the attack vector is over the network. The exploitation is straightforward and has been publicly disclosed, increasing the risk of active attacks. An attacker can send a crafted HTTP request to the vulnerable IIS-K3CloudMiniApp component, manipulating the filePath argument to target arbitrary files on the server [1].

Impact

Successful exploitation enables an attacker to delete arbitrary files on the affected system. This could lead to denial of service, data loss, or potential further compromise depending on the files removed. The vulnerability is classified as medium severity with a CVSS v3 score of 5.3.

Mitigation

Kingdee recommends temporarily disabling external network access to the Kingdee Cloud Galaxy Retail System or setting up an IP whitelist for access control as a short-term measure. For long-term remediation, users should install the official security patch provided by the Starry Sky system. The patch involves adding authentication to the vulnerable CMKAppWebHandler.ashx interface and removing the file reading function [1].