# CVE-2025-8852: WuKongOpenSource WukongCRM information disclosure in /adminFile/upload

Source: https://junglewise.ai/threats/cve-2025-8852-wukongopensource-wukongcrm-information-disclosure-in-adminfile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-11. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-8852 · Severity: medium · CVSS 4.3 · Published 2025-08-11

A security vulnerability in WukongCRM, a customer relationship management system, allows authenticated users to see internal server file paths. When a user uploads a file, the system inadvertently reveals the exact location on the server's hard drive where the file is stored. While this does not directly allow data theft, it provides attackers with a map of the server's internal structure, which can be used to plan more complex attacks like data breaches or system takeovers.

Technologies: [5kcrm Wukong Crm](https://junglewise.ai/threats/technologies/wukong-crm). Vendors: [5kcrm](https://junglewise.ai/threats/vendors/5kcrm).

## Quick answers

**Is CVE-2025-8852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-8852 being exploited in the wild.

**How severe is CVE-2025-8852?** Medium severity, with a CVSS score of 4.3, published 11 August 2025.

**Which products and versions are affected?** WuKongOpenSource WukongCRM-11.0-JAVA 11.0.

**Is there a fix for CVE-2025-8852?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-8852 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-8852?** Check whether you run 5kcrm Wukong Crm or WuKongOpenSource WukongCRM-11.0-JAVA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-209/CWE-200) exists in WukongCRM 11.0 within the /adminFile/upload endpoint. The root cause is an improperly configured Data Transfer Object (DTO) layer that returns the full backend entity object to the frontend instead of a sanitized version. This results in the API response containing the 'absolute file path' of the uploaded file on the server. A remote attacker with low privileges (authenticated user) can exploit this to map the server's directory structure, facilitating secondary attacks such as path traversal or local file inclusion. A public PoC has been disclosed.

## Affected products

- WuKongOpenSource WukongCRM-11.0-JAVA 11.0

## Timeline

- 2025-07-29: disclosed: Vulnerability reported on GitHub issues
- 2025-08-11: advisory: CVE-2025-8852 published

## References

- [https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26](https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26)
- [https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26](https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26)
- [https://vuldb.com/?ctiid.319383](https://vuldb.com/?ctiid.319383)
- [https://vuldb.com/?id.319383](https://vuldb.com/?id.319383)
- [https://vuldb.com/?submit.624693](https://vuldb.com/?submit.624693)

## Related threats

- [WuKongOpenSource WukongCRM improper authorization in URL Handler](https://junglewise.ai/threats/cve-2026-2141-wukongopensource-wukongcrm-improper-authorization-in-url-handler)
- [WukongCRM fastjson deserialization in OaExamineController](https://junglewise.ai/threats/cve-2025-60828-wukongcrm-fastjson-deserialization-in-oaexaminecontroller)