TI-2025-06470 Aliases CVE-2025-7108 GHSA-8v94-68h6-68c2

risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal

MEDIUM 57CWE-22Published 2025-07-07 · Updated 2025-07-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile of the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java. The manipulation of the argument fullPath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00456 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
risesoft-y9	Digital-Infrastructure	9.6.0; 9.6.1; 9.6.2; 9.6.3; 9.6.4; 9.6.5; 9.6.6; 9.6.7	—	No fix listed	CNA

Digital-Infrastructure Vendorrisesoft-y9 Affected 9.6.0; 9.6.1; 9.6.2; 9.6.3; 9.6.4; 9.6.5; 9.6.6; 9.6.7 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-7108
2026-10-03 Alias added: GHSA-8v94-68h6-68c2

References

Exploit 1

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250621-01.md

TI-2026-65446 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection CVSS 4.0MEDIUM 6.9
TI-2026-00785 risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection CVSS 4.0MEDIUM 6.9
TI-2026-72000 Path traversal in Risesoft-y9 Digital-Infrastructure lets attackers write files CVSS 4.0HIGH 8.8
TI-2026-71999 Path traversal in Risesoft Digital-Infrastructure file retrieval CVSS 4.0HIGH 8.7
TI-2026-75437 Risesoft Digital-Infrastructure exposes other tenants' personnel data CVSS 4.0HIGH 7.1
TI-2026-72002 Missing authorization in WorkFlow-Engine task buttonOperation endpoints CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences