CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2022-50973 — Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability ...

·Source: NIST NVD

Updated:

Executive Summary

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a m

Analysis

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC). CVSS Score: 9.8. Published: 2026-07-02T17:16:56.947.

Indicators of Compromise (1)

CVE (1)
CVE-2022-50973
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 2, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Apple Reverses Age-Old Patch Policy to Keep Up With AI

Expect more compressed patching cycles from Apple going forward, as attackers leverage artificial intelligence to reduce time to exploit.

Dark Reading
MEDIUMVulnerability

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic. Working with the FBI, Lumen, and others, Google's Threat Intelligence Group (GTIG) said this week it had reduced the network's pool of usable devices by millions. Google identifies NetNut, also tracked as Popa, as a network spread across home

The Hacker News
MEDIUMVulnerability

Global Schools Holdings Cites Two Injunctions in a Bid to Chill Our Reporting. It Won’t Work.

My About page is pretty clear about legal threats: If you want to send me legal threats about my reporting or comments, knock yourself out, but don’t be surprised to see me report on your threat, any confidentiality sig blocks you may attach notwithstanding. I have been threatened with lawsuits many times, and to be... Source

DataBreaches.net