CVE-2025-7626

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7626
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/13 Exploit Issue Tracking Vendor Advisory
https://vuldb.com/?ctiid.316327 Permissions Required VDB Entry
https://vuldb.com/?id.316327 Third Party Advisory VDB Entry
https://vuldb.com/?submit.609078 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:yijiusmile:kkfileviewofficeedit:*:*:*:*:*:*:*:*
History

07 Nov 2025, 19:36

Type Values Removed Values Added
References () https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/13 - () https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/13 - Exploit, Issue Tracking, Vendor Advisory
References () https://vuldb.com/?ctiid.316327 - () https://vuldb.com/?ctiid.316327 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.316327 - () https://vuldb.com/?id.316327 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.609078 - () https://vuldb.com/?submit.609078 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:yijiusmile:kkfileviewofficeedit:*:*:*:*:*:*:*:*
First Time Yijiusmile
Yijiusmile kkfileviewofficeedit

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad en YiJiuSmile kkFileViewOfficeEdit hasta 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd, clasificada como crítica. Esta vulnerabilidad afecta a la función onlinePreview del archivo /onlinePreview. La manipulación del argumento url provoca un path traversal. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. Este producto no utiliza control de versiones. Por ello, no hay información disponible sobre las versiones afectadas y no afectadas.

14 Jul 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-14 17:15

Updated : 2025-11-07 19:36

NVD link : CVE-2025-7626

Mitre link : CVE-2025-7626

CVE.ORG link : CVE-2025-7626

JSON object : View

Products Affected

yijiusmile

  • kkfileviewofficeedit
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')