Is CVE-2025-15098 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15098 being exploited in the wild.

How severe is CVE-2025-15098?

Medium severity, with a CVSS score of 6.3, published 26 December 2025.

Which products and versions are affected?

YunaiV Yudao-Cloud up to 2025.11.

Is there a fix for CVE-2025-15098?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15098 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15098?

Check whether you run YunaiV Yudao-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15098: YunaiV yudao-cloud SSRF in Business Process Management component

CVE-2025-15098 · Severity: medium · CVSS 6.3 · Published 2025-12-26

YunaiV yudao-cloud is a microservices framework used for building enterprise-level backend systems. A security flaw in its business process management component allows authorized users to force the server to make unintended network requests. This could allow an attacker to scan internal company networks, access private services not exposed to the internet, or disrupt internal operations.

Technologies: YunaiV Yudao-Cloud. Vendors: YunaiV.

Quick answers

Is CVE-2025-15098 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15098 being exploited in the wild.
How severe is CVE-2025-15098?: Medium severity, with a CVSS score of 6.3, published 26 December 2025.
Which products and versions are affected?: YunaiV Yudao-Cloud up to 2025.11.
Is there a fix for CVE-2025-15098?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15098 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15098?: Check whether you run YunaiV Yudao-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Business Process Management (BPM) component of YunaiV yudao-cloud up to version 2025.11. The issue is located within the BpmHttpCallbackTrigger and BpmSyncHttpRequestTrigger functions, where insufficient validation of the url, header, and body arguments allows for request manipulation. An authenticated attacker with BPM process design permissions can exploit this to send arbitrary HTTP requests from the application server. This can be used to pivot into internal network segments or interact with internal metadata services. As of the advisory date, the vendor has not responded to disclosure attempts, and a public exploit is available.

Affected products

YunaiV yudao-cloud up to 2025.11

Timeline

2025-12-25: disclosed: Public disclosure of the vulnerability and exploit code.
2025-12-26: advisory: NVD/VulDB advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.