# CVE-2025-66744: YonBIP - Path Traversal

> Live exploitation tracking for CVE-2025-66744 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-66744

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Yonyou YonBIP
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information.

## CrowdSec analysis

[CVE-2025-66744](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-66744) is a high-severity path traversal vulnerability in Yonyou YonBIP v3 and earlier, affecting the LoginWithV8 interface of the series data application service system. Due to improper input validation, unauthenticated remote attackers can manipulate file path parameters in the ticket query string to traverse directories and access sensitive system files, potentially exposing confidential configuration data and credentials.

CrowdSec has been tracking this vulnerability and its exploits since 18th of March 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-66744 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-66744 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-66744 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the `/bi/api/Portal/LoginWithV8/` endpoint by injecting path traversal sequences (e.g., `../../../../`) into the `ticket` GET parameter to read arbitrary files such as `win.ini` from the underlying server.

## Timeline

- 2026-01-09: CVE Published. CVE-2025-66744 is published to NVD.
- 2026-03-18: Rule Released. CrowdSec releases a rule to detect CVE-2025-66744 exploitation attempts against the CrowdSec Network.
- 2026-03-30: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-66744 for the first time.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-66744
- https://github.com/iSee857/YonYouBip-path-travel
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66744.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-66744) follows observed exploitation activity for CVE-2025-66744. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.