CVE-2025-11139 is a medium severity (6.3) path traversal flaw in Bjskzy Zhiyou ERP up to version 11.0. The filepath argument of the uploadStudioFile function is not constrained. The record lists no fixed version, so limit access to the service and watch the vendor for a patch.
What's affected
The record lists Bjskzy Zhiyou ERP up to and including 11.0. The affected function is uploadStudioFile in the component com.artery.form.services.FormStudioUpdater, through the filepath argument. CVSS 6.3 (medium severity), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Fixed versions: none are named in the record. The record says the vendor was contacted early and did not respond.
How to check if you're exposed
First find out whether you run it at all. Search your asset list, container images and web roots for Bjskzy Zhiyou ERP. On a Linux host you can look for the vulnerable file name directly.
find / -name "uploadStudioFile" -not -path "/proc/*" 2>/dev/null
Review recent file writes under the application directory and compare them with your deployment records. Check request logs for the upload function with path style values in the filepath argument, such as repeated parent directory markers.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Limit access to the service to trusted networks.
- Ask the vendor for a fixed release and for written confirmation of status.
- Run the service under an account that cannot write outside its own data directory, so a path trick has less to reach.
- Review recent files written by the service and compare with your deployment records.
- Add the product to your watch list so you hear when a patch lands.
Why it matters
The record classes this as CWE-22 (path traversal). The program builds a file path from a user supplied value and does not confirm the final location stays inside the directory it meant to use.
This is a fix developers can make in a few lines and a test, which makes the missing vendor reply more frustrating. The record says exploit details are public. It is not on CISA KEV in the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version?
The CVE record names none. Ask the vendor and limit network access in the meantime.
How does this class of bug get fixed?
The code resolves the final path and refuses anything outside the intended directory.
Sources
Last reviewed: 19 October 2026.
