Vulnerability · Published Nov 16, 2025 · Assigned by VulDB

CVE-2025-13249Jiusi OA OfficeServer unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in OA from Jiusi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDownloadTemplate=false of the component OfficeServer Interface. Such manipulation of the argument FileData leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Affected products (as reported)

Vendor	Product	Versions
Jiusi	OA	20251102

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-332583 | Jiusi OA OfficeServer unrestricted upload vdb-entry, technical-description
VDB-332583 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #687599 | http://www.jiusi.net/ jiusiOA n/a Arbitrary file upload vulnerability third-party-advisory
https://github.com/rooboot501/my-project/blob/main/jiousi.md exploit