PT-2025-23678 · Oa System · Oa System

Aaluoxiang · Published 2025-06-03 · Updated 2026-01-16 · CVE-2025-5544

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions aaluoxiang oa system versions up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5

Description A vulnerability was found in the image function of the UserpanelController.java file, which can lead to path traversal. The attack may be launched remotely. The issue has been rated as problematic.

Recommendations For versions up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5, as a temporary workaround, consider restricting access to the image function of the UserpanelController.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-5544

Affected Products

Oa System

References · 10

• 🔥 https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead01.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5544 · Security Note
• https://t.me/cvenotify/124546 · Telegram Post
• https://t.me/cveNotify/138868 · Telegram Post
• https://vuldb.com/?id.310994 · Note
• https://twitter.com/CVEnew/status/1930044961204121610 · Twitter Post
• https://t.me/cvetracker/25331 · Telegram Post
• https://vuldb.com/?submit.585884 · Note
• https://twitter.com/vuldb/status/2011992699088298299 · Twitter Post
• https://vuldb.com/?ctiid.310994 · Note