Vulnerability · Published Nov 15, 2025 · Assigned by VulDB

CVE-2025-13209bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference

Medium 6.3

In plain English

A medium-severity XML external entity in oa_git_free from bestfeng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Affected products (as reported)

Vendor	Product	Versions
bestfeng	oa_git_free	9.09.19.29.39.49.5

Weakness: CWE-611, CWE-610 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-332528 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference vdb-entry, technical-description
VDB-332528 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #685626 | https://gitee.com/bestfeng/oa_git_free oa_git_free 8.0 XML external entity injection third-party-advisory
https://github.com/bkglfpp/CVE-md/blob/main/%E4%BA%91%E7%BD%91%E5%8D%8F%E5%90%8C%E5%8A%9E%E5%85%AC%E7%B3%BB%E7%BB%9F/XXE.md exploit