YonBIP - Path Traversal (CVE-2025-66744)

CVE-2025-66744 is a high-severity path traversal vulnerability in Yonyou YonBIP v3 and earlier, affecting the LoginWithV8 interface of the series data application service system. Due to improper input validation, unauthenticated remote attackers can manipulate file path parameters in the ticket query string to traverse directories and access sensitive system files, potentially exposing confidential configuration data and credentials.

CrowdSec has been tracking this vulnerability and its exploits since 18th of March 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-66744 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-66744 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-66744 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /bi/api/Portal/LoginWithV8/ endpoint by injecting path traversal sequences (e.g., ../../../../) into the ticket GET parameter to read arbitrary files such as win.ini from the underlying server.