PT-2025-29488 · Yijiusmile · Kkfileviewofficeedit

Bi8Bu · Published 2025-07-14 · Updated 2025-07-14 · CVE-2025-7625

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: YiJiuSmile kkFileViewOfficeEdit (affected versions not specified)

Description: A critical issue exists in the Download function of the /download API endpoint in YiJiuSmile kkFileViewOfficeEdit. Manipulation of the url argument can lead to a path traversal. This issue is remotely exploitable, and details about the exploit have been publicly disclosed. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-7625

Affected Products

Kkfileviewofficeedit

References · 8

• 🔥 https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/12 · Exploit
• https://osv.dev/vulnerability/CVE-2025-7625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7625 · Security Note
• https://vuldb.com/?submit.609076 · Note
• https://vuldb.com/?ctiid.316326 · Note
• https://twitter.com/CVEnew/status/1944801991999308142 · Twitter Post
• https://t.me/cvetracker/27807 · Telegram Post
• https://vuldb.com/?id.316326 · Note