CVE-2025-15098
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability exists in the Business Process Management component of YunaiV yudao-cloud up to version 2025.11. An attacker can remotely manipulate url/header/body arguments in BpmHttpCallbackTrigger and BpmSyncHttpRequestTrigger functions. The exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources and potential escalation of attacks against other systems.
Recommendation
Immediately update YunaiV yudao-cloud to the latest version or apply available patches. Restrict access to the BPM component to trusted networks only.
Original NVD description (English source)
A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.