CVE-2025-66744
Published: 09 January 2026
Summary
CVE-2025-66744 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the path traversal flaw in the LoginWithV8 interface of Yonyou YonBIP by identifying, reporting, and correcting the specific vulnerability.
Requires validation of user-supplied path inputs to the LoginWithV8 interface, preventing traversal sequences like '../' from accessing sensitive files outside intended directories.
Enforces logical access controls on sensitive system files and resources, limiting damage from successful path traversal by restricting read permissions based on approved authorizations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing LoginWithV8 web interface directly enables remote unauthenticated file access, matching T1190 Exploit Public-Facing Application.
NVD Description
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system
Deeper analysisAI
CVE-2025-66744 is a path traversal vulnerability (CWE-22) affecting Yonyou YonBIP version 3 and prior versions, specifically in the LoginWithV8 interface of the series data application service system. This flaw enables unauthorized access to sensitive information within the system. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no impact on integrity or availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows unauthenticated adversaries to traverse paths and access sensitive system files, potentially exposing confidential data.
References include a GitHub repository at https://github.com/iSee857/YonYouBip-path-travel, which likely contains proof-of-concept details for the path traversal issue, though specific mitigation guidance from official advisories is not detailed in available information.
Details
- CWE(s)