Vulnerability · Published May 5, 2025 · Assigned by VulDB

CVE-2025-4260zhangyanbo2007 youkefu TemplateController.java impsave deserialization

Medium 4.3

In plain English

A medium-severity unsafe deserialization in youkefu from zhangyanbo2007. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 45.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web\handler\admin\system\TemplateController.java. The manipulation of the argument dataFile leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
zhangyanbo2007	youkefu	4.04.14.2.0

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-307364 | zhangyanbo2007 youkefu TemplateController.java impsave deserialization vdb-entry, technical-description
VDB-307364 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #562902 | youkefu https://github.com/zhangyanbo2007/youkefu 1.0 反序列化 third-party-advisory
https://github.com/Serein123y/vulnerability/blob/main/vul.md exploit