The Zhiyuan OA Web Application System contains an unrestricted file upload vulnerability (CWE-434) combined with path traversal (CWE-22) in the wpsAssistServlet interface. The parameters realFileType and fileId are not properly validated during multipart file uploads, allowing attackers to upload malicious JSP files outside the intended directories. These files can then be executed remotely, resulting in remote code execution without authentication. The vulnerability affects versions 5.0 through 8.0 of the product. Exploitation was confirmed by Shadowserver Foundation in early 2025. The CVSS 4.0 score is 10, indicating critical severity. No vendor patch or mitigation guidance is currently available.

Successful exploitation allows unauthenticated remote attackers to upload and execute arbitrary JSP files on the affected web server, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 10, reflecting its ease of exploitation and severe impact. Exploitation evidence has been observed in the wild, increasing the urgency of addressing this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the wpsAssistServlet interface, implement strict input validation and file upload controls, and monitor for suspicious file uploads or web shell activity. Avoid exposing the affected versions publicly and consider temporary network-level restrictions to reduce attack surface.