CVE-2025-15098

Name of the Vulnerable Software and Affected Versions YunaiV yudao-cloud versions prior to 2025.11

Description A server-side request forgery condition exists in the Business Process Management component, specifically within the BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger function. Manipulation of the url, header, or body arguments can be exploited to perform server-side request forgery attacks remotely. The exploit has been publicly disclosed, and the vendor was notified but did not respond.

Recommendations Versions prior to 2025.11 should be updated. As a temporary workaround, consider restricting access to the BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger function until a patch is available. Avoid using untrusted data in the url, header, or body parameters.