CVE-2025-8852
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In WuKongOpenSource WukongCRM 11.0, a vulnerability in the /adminFile/upload file of the API Response Handler component leads to information exposure through error messages. The attack can be performed remotely, and exploit details are publicly available.
Risk Assessment
The organization is at risk of leaking sensitive system information that could be used for further attacks or privilege escalation.
Recommendation
Immediately update WukongCRM to the latest version or apply temporary mitigations such as disabling detailed error messages in the API.
Other vulnerabilities in WukongCRM
See all- CVE-2026-2141Medium
A security flaw in WukongCRM up to version 11.3.3 affects the URL Handler component in PermissionServiceImpl.java. Manipulation leads to improper authorization, allowing remote exploitation. A public exploit is available, and the vendor has not responded.
- CVE-2025-60828Medium
A fastjson deserialization vulnerability was discovered in WukongCRM-9.0-JAVA via the /OaExamine/setOaExamine interface. An attacker can remotely exploit this flaw to execute arbitrary code.
- CVE-2025-5521Medium
A cross-site request forgery (CSRF) vulnerability was found in WuKongOpenSource WukongCRM 9.0 in the file /system/user/updataPassword. The attack can be launched remotely, and exploit details have been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS