CVE-2025-10816 is a high severity (CVSS 7.3) XML external entity flaw in Jinher OA 2.0, in an XML handler under the ToolBar module. The record lists no fixed version, so ask the vendor, restrict access to the application and disable external entity use in the parser where you control it.
What's affected
The record lists Jinher OA 2.0. The description places the issue in an unknown part of /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx in the XML handler component, where manipulation results in an XML external entity reference. It can be reached remotely, and the record says an exploit has been released to the public.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with low to moderate impact in each area.
Fixed versions: the record names none, and the only references are a public issue and VulDB entries. The vendor advisory, if any, should be checked directly.
The weakness classes are CWE-611 (improper restriction of XML external entity reference) and CWE-610 (externally controlled reference to a resource in another sphere).
How to check if you're exposed
Jinher OA is a business application installed on a server, so there is no package manager check.
- Confirm whether your organisation runs Jinher OA and which version. The record covers 2.0.
- Ask the vendor or integrator for the build details and any patch notice.
- Check whether the application is reachable from the internet, and by which paths.
- Search web server logs for requests to the named handler page, and note who sent them and how often.
- If you manage a reverse proxy, look at the response codes for that path over the last months.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses.
What to do now
- Confirm whether Jinher OA 2.0 is in use and who owns it.
- Contact the vendor for a fixed build and ask for written confirmation of the version.
- Block the named handler path at a proxy or firewall if the feature is not needed.
- Limit the application to internal networks or a VPN.
- If your team can change the XML parser settings, disable document type definitions and external entities.
- Review logs for requests to the handler and for unusual file access on the server.
- Reduce what the application account can read on disk, so that file disclosure would reveal less.
Why it matters
XML parsers can follow references that point to files or to remote servers. If a parser reads untrusted XML with those features switched on, the sender can make the server read local files or contact other hosts. That is the whole class, and the standard fix is to turn the features off.
This record is thin. It gives a path and a class, not a root cause write up, so we do not claim more. The KEV flag is false. Because a public exploit is reported, exposed installs deserve attention first.
Quick check
Is there a fix for CVE-2025-10816?
The record names none. Contact the vendor and confirm a fixed build in writing.
What does XXE let someone do?
It can let a sender make the server read local files or reach other systems, depending on parser settings. Turning off external entities in the parser is the standard defence.
Sources
Last reviewed: 19 October 2026.
