Is CVE-2025-8852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8852 being exploited in the wild.

How severe is CVE-2025-8852?

Medium severity, with a CVSS score of 4.3, published 11 August 2025.

Which products and versions are affected?

WuKongOpenSource WukongCRM-11.0-JAVA 11.0.

Is there a fix for CVE-2025-8852?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-8852 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-8852?

Check whether you run 5kcrm Wukong Crm or WuKongOpenSource WukongCRM-11.0-JAVA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8852: WuKongOpenSource WukongCRM information disclosure in /adminFile/upload

CVE-2025-8852 · Severity: medium · CVSS 4.3 · Published 2025-08-11

A security vulnerability in WukongCRM, a customer relationship management system, allows authenticated users to see internal server file paths. When a user uploads a file, the system inadvertently reveals the exact location on the server's hard drive where the file is stored. While this does not directly allow data theft, it provides attackers with a map of the server's internal structure, which can be used to plan more complex attacks like data breaches or system takeovers.

Technologies: 5kcrm Wukong Crm. Vendors: 5kcrm.

Quick answers

Is CVE-2025-8852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8852 being exploited in the wild.
How severe is CVE-2025-8852?: Medium severity, with a CVSS score of 4.3, published 11 August 2025.
Which products and versions are affected?: WuKongOpenSource WukongCRM-11.0-JAVA 11.0.
Is there a fix for CVE-2025-8852?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-8852 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-8852?: Check whether you run 5kcrm Wukong Crm or WuKongOpenSource WukongCRM-11.0-JAVA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability (CWE-209/CWE-200) exists in WukongCRM 11.0 within the /adminFile/upload endpoint. The root cause is an improperly configured Data Transfer Object (DTO) layer that returns the full backend entity object to the frontend instead of a sanitized version. This results in the API response containing the 'absolute file path' of the uploaded file on the server. A remote attacker with low privileges (authenticated user) can exploit this to map the server's directory structure, facilitating secondary attacks such as path traversal or local file inclusion. A public PoC has been disclosed.

Affected products

WuKongOpenSource WukongCRM-11.0-JAVA 11.0

Timeline

2025-07-29: disclosed: Vulnerability reported on GitHub issues
2025-08-11: advisory: CVE-2025-8852 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.