CVE-2023-54398

CriticalCVSS 9.8/10Last modified Sep 24, 2026

Description

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-543999.8Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is CVE-2023-544009.8Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to CVE-2023-544027.5iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fe CVE-2023-544037.5Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attac CVE-2023-544047.5Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitt CVE-2023-544059.8H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vuln CVE-2023-544064.9Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during CVE-2023-544074.9Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored i CVE-2023-544086.1Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rend CVE-2023-544094.8Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes CVE-2023-54415.5NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.CVE-2023-544104.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a m