CVE-2026-1218 is an XML External Entity (XXE) vulnerability identified in Bjskzy Zhiyou ERP up to version 11.0, affecting the initRCForm function within the RichClientService.class component of com.artery.richclient.RichClientService. The vulnerability arises from improper handling of XML input, allowing an attacker to craft malicious XML containing external entity references. When processed, this can lead to disclosure of internal files, server-side request forgery (SSRF), or denial of service conditions. The attack can be performed remotely without user interaction but requires low privileges, indicating that an attacker with limited access could exploit it. The vendor was notified but has not provided a patch or mitigation guidance, and while the exploit code is publicly available, no active exploitation has been reported. The CVSS v4.0 score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability. This vulnerability is significant for organizations relying on this ERP system, as it could expose sensitive business data or disrupt operations if exploited.

For European organizations using Bjskzy Zhiyou ERP 11.0, this vulnerability poses risks including unauthorized disclosure of sensitive corporate data, potential disruption of ERP services, and indirect impacts on business continuity. Given the ERP’s role in managing enterprise resources, exploitation could lead to leakage of financial, operational, or personal data, undermining confidentiality. Integrity and availability impacts, while partial, could affect business processes dependent on the ERP system. The remote exploitability and lack of required user interaction increase the threat surface. Organizations in sectors such as manufacturing, logistics, or services that rely heavily on this ERP could face operational disruptions and reputational damage. The absence of vendor patches increases the urgency for internal mitigations. Additionally, regulatory compliance risks arise if sensitive data is exposed, especially under GDPR.

1. Immediately disable XML external entity processing in all XML parsers used by the ERP system, if configurable. 2. Implement strict input validation and sanitization on all XML inputs to the initRCForm function or related services. 3. Employ network-level controls such as web application firewalls (WAFs) with rules to detect and block malicious XML payloads containing external entity references. 4. Monitor logs and network traffic for unusual outbound requests or error messages indicative of XXE exploitation attempts. 5. Isolate the ERP system within a segmented network zone with restricted outbound internet access to limit SSRF impact. 6. Engage with the vendor for updates or patches and consider alternative ERP solutions if no remediation is forthcoming. 7. Conduct internal security assessments and penetration tests focusing on XML processing components. 8. Educate IT and security teams about this vulnerability and ensure incident response plans include XXE scenarios.