CVE-2025-12140

Critical

Published: 27/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' value. The application interprets the input string as a Java expression, allowing an unauthenticated attacker to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353.

Risk Assessment

An unauthenticated attacker can execute arbitrary code remotely within the application context, potentially leading to full system compromise and data breach.

Recommendation

Update the application to version wu#2016.1.5513#0#20251014_113353 or later. If possible, restrict access to the application to trusted users only.

Original NVD description (English source)

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353