CVE-2025-8516 is a path traversal vulnerability in Kingdee Cloud-Starry-Sky Enterprise Edition up to version 8.2. It affects the BaseServiceFactory.getFileUploadService.deleteFileAction function within the IIS-K3CloudMiniApp component. The vulnerability allows remote attackers to manipulate the filePath argument to access unauthorized files. The vendor has publicly disclosed the exploit and recommends temporarily disabling external network access or implementing IP whitelisting. A security patch is planned that will add authentication to the vulnerable interface and remove the file reading function.