# CVE-2025-34040: OA - Path Traversal

> Live exploitation tracking for CVE-2025-34040 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34040

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Beijing Zhiyuan Internet Software Co., Ltd. OA
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type); CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_server

## Description

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.

## CrowdSec analysis

[CVE-2025-34040](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34040) is a severe path traversal vulnerability in the Zhiyuan OA platform that allows unauthenticated attackers to upload arbitrary files, including malicious JSP scripts, outside of intended directories via the wpsAssistServlet interface. By exploiting improper validation of the realFileType and fileId parameters, attackers can achieve remote code execution on the affected server, potentially leading to full system compromise. This vulnerability poses a significant risk for organizations using vulnerable versions of the Zhiyuan OA platform.

CrowdSec has been tracking this vulnerability and its exploits since 16th of July 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-34040 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34040 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/seeyon/wpsAssistServlet` endpoint by sending crafted POST requests with path traversal in the `realFileType` parameter, enabling arbitrary file upload and potential remote code execution on vulnerable Zhiyuan OA Platform instances.

## Timeline

- 2025-06-24: CVE Published. CVE-2025-34040 is published to NVD.
- 2025-07-16: Rule Released. CrowdSec releases a rule to detect CVE-2025-34040 exploitation attempts against the CrowdSec Network.
- 2025-07-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34040 for the first time.

## References

- https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
- https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1
- https://www.cnblogs.com/pursue-security/p/17677130.html
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34040.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34040) follows observed exploitation activity for CVE-2025-34040. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.