Path Traversal Vulnerability in Kingdee Cloud-Starry-Sky Enterprise Edition
CVE-2025-8516

6.9MEDIUM

Key Information:

Vendor: Kingdee
Status: Cloud-starry-sky Enterprise Edition
Vendor: CVE Published:; 4 August 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-8516?

A vulnerability has been identified in Kingdee Cloud-Starry-Sky Enterprise Edition, which affects the function BaseServiceFactory.getFileUploadService.deleteFileAction. This issue arises from improper handling of the filePath argument in the FileUploadAction component of the system. An attacker can exploit this vulnerability remotely, gaining unauthorized access to sensitive files through path traversal techniques. The vendor has advised temporarily disabling external network access or implementing IP whitelisting as an immediate mitigation measure. Long-term solutions involve applying a security patch that will reinforce authentication on the affected interface and remove the file reading functionality to enhance security.

Affected Version(s)

Cloud-Starry-Sky Enterprise Edition 8.0

Cloud-Starry-Sky Enterprise Edition 8.1

Cloud-Starry-Sky Enterprise Edition 8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-8516 - Proof of Concept