CVE-2025-70058

Deeper analysis

CVE-2025-70058 is an instance of CWE-295 (Improper Certificate Validation) affecting YMFE yapi version 1.12.0. The vulnerability arises because the application disables TLS/SSL certificate validation by explicitly setting 'rejectUnauthorized': false in the HTTPS agent configuration used for Axios requests. This misconfiguration exposes the application to risks associated with unverified server certificates during outbound HTTPS communications. The issue carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to potential impacts on confidentiality and integrity.

Remote attackers with network access can exploit this vulnerability through a man-in-the-middle (MITM) attack, though it requires high attack complexity, such as controlling a network segment or compromising a trusted certificate authority. No privileges, user interaction, or scope change are needed. Successful exploitation allows attackers to intercept sensitive data in transit or tamper with request/response payloads, leading to high confidentiality and integrity violations without affecting availability.

For mitigation details and further analysis, refer to the provided references, including a GitHub Gist at https://gist.github.com/zcxlighthouse/11c53803faf23f607c2787c166e811d4 detailing the issue, as well as the YMFE organization page at https://github.com/YMFE and the yapi repository at https://github.com/YMFE/yapi. The vulnerability was published on 2026-02-23T16:29:36.433.