Unauthenticated Arbitrary File Write Vulnerability in Seeyon OA A8
CVE-2019-25714

9.3CRITICAL

Key Information:

Vendor: Seeyon Internet Software
Status: A8-v5 Collaborative Management Software; A8+ Collaborative Management Software
Vendor: CVE Published:; 21 April 2026

🔔 Create Seeyon Internet Software Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-25714?

Seeyon OA A8 is vulnerable to an unauthenticated arbitrary file write issue within the /seeyon/htmlofficeservlet endpoint. This vulnerability allows remote attackers to send specially crafted POST requests containing base64-encoded payloads, enabling them to write arbitrary files to the web application root. By exploiting this vulnerability, attackers can deploy JSP web shells to the web root and execute them via the web server, potentially gaining the ability to perform arbitrary OS command execution with the privileges of the web server.

Affected Version(s)

A8-V5 Collaborative Management Software 6.1sp1

A8+ Collaborative Management Software 7.0

A8+ Collaborative Management Software 7.0sp1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-25714 - Proof of Concept