CVE-2022-50973 Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet
Unauthenticated attackers can upload arbitrary files, including JSP webshells, to achieve remote code execution on Yonyou KSOA servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50973?
CVE-2022-50973 is a critical vulnerability in Yonyou Network Technology Co., Ltd. KSOA, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).
Weakness: CWE-434
Which versions are affected by CVE-2022-50973?
How do I fix CVE-2022-50973?
No fix has been published for CVE-2022-50973 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-50973 being exploited?
There is no known exploitation of CVE-2022-50973 in the wild and no public exploit code.
Sources
Also known as GHSA-2pg7-g8qf-mcv3.