The Zhiyuan OA Web Application System contains an unrestricted file upload vulnerability (CWE-434) combined with path traversal (CWE-22) in the wpsAssistServlet interface. Improper validation of the realFileType and fileId parameters during multipart uploads allows attackers to upload malicious JSP files outside intended directories. These files can then be accessed and executed remotely, resulting in full remote code execution without authentication. The vulnerability affects versions 5.0 through 8.0 and has a CVSS 4.0 base score of 10.0, indicating critical severity. Exploitation was confirmed by Shadowserver Foundation on 2025-02-01 UTC. No patch or official fix information is currently available.

Successful exploitation allows unauthenticated remote attackers to upload and execute arbitrary JSP files on the affected server, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the system and potentially the entire network environment hosting the Zhiyuan OA platform. Given the critical CVSS score and confirmed exploitation evidence, this vulnerability poses a severe risk to affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the vulnerable interface, applying web application firewall rules to block malicious upload attempts, and monitoring for suspicious file uploads or unexpected JSP files. Do not rely on generic mitigations; focus on controls specific to file upload validation and path traversal prevention for this product.