PT-2025-39807 · Unknown · Bjskzy Zhiyou Erp

Nu11 · Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-11139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A path traversal issue exists in Bjskzy Zhiyou ERP. The uploadStudioFile function within the com.artery.form.services.FormStudioUpdater component is affected. Manipulation of the filepath argument can lead to path traversal. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Update Bjskzy Zhiyou ERP to a version later than 11.0. As a temporary workaround, restrict access to the uploadStudioFile function until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-11139

Affected Products

Bjskzy Zhiyou Erp

References · 9

• 🔥 https://github.com/FightingLzn9/vul/blob/main/%E6%97%B6%E7%A9%BA%E6%99%BA%E5%8F%8Berp-2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11139 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11139 · Vendor Advisory
• https://twitter.com/CVEnew/status/1972516468727111949 · Twitter Post
• https://t.me/cveNotify/136768 · Telegram Post
• https://t.me/CVEtracker/33609 · Telegram Post
• https://vuldb.com/?submit.658077 · Note
• https://vuldb.com/?id.326216 · Note
• https://vuldb.com/?ctiid.326216 · Note