CVE-2025-4258 - zhangyanbo2007 youkefu MediaController.java upload unrestricted upload

Back Back to CVE browser

MEDIUM

zhangyanbo2007 youkefu MediaController.java upload unrestricted upload

Published May 5, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.43%

Description

A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Zhangyanbo2007 Product Youkefu Default
n/a
- Version
  4.0
  Status
  affected
  Constraints
  -
- Version
  4.1
  Status
  affected
  Constraints
  -
- Version
  4.2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zhangyanbo2007

Youkefu

n/a

Version	Status	Constraints
4.0	affected	-
4.1	affected	-
4.2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (4)

https://github.com/Fc04dB/VUL/blob/main/ukefu_upload.md
exploitBroken Link
https://vuldb.com/?ctiid.307362
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.307362
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.562848
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/Fc04dB/VUL/blob/main/ukefu_upload.md		exploitBroken Link
https://vuldb.com/?ctiid.307362		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.307362		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.562848		third-party-advisoryThird Party AdvisoryVDB Entry