CVE-2025-15503 is a high severity unrestricted file upload (CVSS 7.3) in Sangfor Operation and Maintenance Management System up to 3.0.8. The File argument of /fort/trust/version/common/common.jsp accepts dangerous uploads without authentication per the vector. The vendor did not respond and no fix is confirmed.
What's affected
The record lists the Sangfor Operation and Maintenance Management System up to 3.0.8. The affected file is /fort/trust/version/common/common.jsp, and the manipulated input is the File argument. The record says the result is unrestricted upload and that exploitation is possible remotely. The CVSS vector needs no privileges.
It is the third report in a set that includes CVE-2025-15499 and CVE-2025-15502. The record says the exploit is public and that the vendor was contacted early without responding. No fixed version is named.
An upload flaw on a JSP page is serious because the server can run JSP files. If an uploaded file ends up somewhere the web application serves, an attacker can turn an upload into code execution.
How to check if you're exposed
Check for the product and the path:
- Find Sangfor operation and maintenance appliances in your asset list and confirm the version.
- From outside your admin network, check whether
/fort/paths answer. They should not. - On the server, list recently created files in the web application's directories, with attention to JSP and script files:
find /path/to/webapp -type f -newermt "2026-01-01" \( -name "*.jsp" -o -name "*.jspx" \) 2>/dev/null
- In access logs, review requests to
common.jspand any requests to newly created files soon after.
Any JSP file that you or the vendor did not put there is a finding to escalate.
What to do now
- Confirm whether the product is deployed and whether version 3.0.8 or earlier is running.
- Block
/fort/paths from untrusted networks and remove public exposure of the interface. - Search web directories for JSP or script files that should not be there, and isolate the host if you find one.
- Rotate credentials stored on or reachable from the appliance.
- Ask the vendor for a patch and monitor for updates.
Why it matters
The record lists CWE-434, Unrestricted Upload of File with Dangerous Type, and CWE-284, Improper Access Control. The page accepts a file without checking its type or who sent it. On a platform that executes JSP files, an uploaded script can run with the application's rights.
The score is 7.3 on a network vector with no privileges needed. It is not in CISA's Known Exploited Vulnerabilities catalog per the record. The finding to hunt for is a file that should not exist, which is more telling than any score.
Quick check
What should I look for on the server?
Script or JSP files in the application directories that neither you nor the vendor installed, and requests to them in the access log.
Is any workaround confirmed?
No vendor guidance is confirmed. Restricting network access to the interface is the reliable control.
Sources
Last reviewed: 19 October 2026.
