A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250630-01.md | Exploit Third Party Advisory |
| https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250630-01.md#steps-to-reproduce | Exploit |
| https://vuldb.com/?ctiid.316264 | Permissions Required VDB Entry |
| https://vuldb.com/?id.316264 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.606784 | Third Party Advisory VDB Entry |
Configurations
History
06 Nov 2025, 18:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* | |
| First Time |
Jishenghua
Jishenghua jsherp |
|
| References | () https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250630-01.md - Exploit, Third Party Advisory | |
| References | () https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250630-01.md#steps-to-reproduce - Exploit | |
| References | () https://vuldb.com/?ctiid.316264 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.316264 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.606784 - Third Party Advisory, VDB Entry |
Information
Published : 2025-07-14 04:15
Updated : 2025-11-06 18:59
NVD link : CVE-2025-7566
Mitre link : CVE-2025-7566
CVE.ORG link : CVE-2025-7566
JSON object : View
Products Affected
jishenghua
- jsherp
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')