Vulnerability · Published Jul 2, 2026 · Assigned by VulnCheck

CVE-2022-50973Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet

Critical 9.8

In plain English

A critical-severity unrestricted file upload in KSOA from Yonyou Network Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.5%top 25.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).

Affected products (as reported)

Vendor	Product	Versions
Yonyou Network Technology Co., Ltd.	KSOA	9.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure (1) technical-description, exploit
Researcher Disclosure (2) exploit, technical-description
Researcher Disclosure (3) technical-description, exploit
Vendor Homepage product
https://www.vulncheck.com/advisories/yonyou-ksoa-unauthenticated-file-upload-rce-via-imageupload-servlet third-party-advisory