CVE-2025-8775 is a medium-severity vulnerability identified in the Qiyuesuo Electronic Signature Platform versions up to 4.34. The vulnerability resides in the Scheduled Task Handler component, specifically in the /api/code/upload endpoint's execute function. It allows an attacker to perform an unrestricted file upload by manipulating the 'File' argument. This flaw enables remote attackers to upload arbitrary files without authentication or user interaction, potentially leading to unauthorized code execution or system compromise. The vulnerability has a CVSS 4.0 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, but limited impact on confidentiality, integrity, and availability. Although the vendor was contacted early, no response or patch has been issued, and no known exploits are currently observed in the wild. The unrestricted upload could be leveraged to deploy web shells or malware, facilitating persistent access or lateral movement within affected environments.

For European organizations, this vulnerability poses a significant risk particularly to entities relying on the Qiyuesuo Electronic Signature Platform for document signing and workflow automation. Exploitation could lead to unauthorized access to sensitive documents, manipulation of electronic signatures, and potential disruption of business processes dependent on the platform. The ability to upload arbitrary files remotely without authentication increases the risk of system compromise, data breaches, and reputational damage. Given the critical role of electronic signature platforms in legal, financial, and governmental sectors, exploitation could undermine trust in digital transactions and compliance with EU regulations such as eIDAS. Additionally, compromised systems could serve as footholds for further attacks within corporate networks.

Organizations using Qiyuesuo Electronic Signature Platform should immediately implement compensating controls such as network segmentation to isolate the platform from critical infrastructure and restrict access to the /api/code/upload endpoint via firewall rules or web application firewalls (WAFs). Monitoring and logging upload activity should be enhanced to detect anomalous file uploads. Employ strict file type validation and scanning for malware on uploaded files where possible. Until an official patch is released, consider disabling or restricting the Scheduled Task Handler component if feasible. Conduct thorough security assessments and penetration tests targeting this functionality. Additionally, maintain up-to-date backups and incident response plans to quickly recover from potential compromises. Engage with the vendor for updates and apply patches promptly once available.