CVE-2025-1818 is a medium severity unrestricted file upload flaw in zj1983 zz up to 2024-8, scored 6.3. The upload handler accepts files it should refuse. No fixed version is named, so check the vendor and limit exposure. The record says exploit details are public, and it is not on the CISA KEV list.
What's affected
The CVE record lists zj1983 zz up to 2024-8. The weakness sits in ZfileAction.upload in src/main/java/com/futvan/z/system/zfile, through the file input.
- Product: zj1983 zz
- Affected: up to 2024-8
- Fixed: not named in the CVE record
- Severity: Medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- Known exploited (CISA KEV): no, the record's kev flag is false
The CVE record does not name a fixed version. The vendor advisory, if one exists, should be checked before you rely on any version number. The record states that the vendor was contacted early and did not respond.
The record also says the exploit has been disclosed to the public and may be used. That is a statement about public technical details, not a statement that attacks are underway. KEV status is false, and nothing in the record claims in the wild exploitation.
How to check if you're exposed
This is an application level flaw, so look at the deployment rather than a package list.
- Find every instance of zj1983 zz, including test hosts.
- Compare the installed version with up to 2024-8 from the record.
- Check whether ZfileAction.upload in src/main/java/com/futvan/z/system/zfile is reachable from the internet, and whether it needs a login. The vector says it needs a low privileged account (PR:L in the vector).
- Review the upload directory on disk. Look for files with script or executable extensions, or files you do not recognise, and check their modification times.
- Check whether the web server is configured to execute scripts from the upload directory. If it is, the impact of any bad upload is larger.
Do not run or open unknown files from that directory on a workstation. Copy them to a sandbox for review.
What to do now
- Check the vendor or project page for a fixed release. The record names none, so confirm against the advisory.
- Restrict the upload endpoint at the web server or proxy to trusted users or networks, or take the instance off the internet.
- Make sure the upload directory cannot execute scripts. Serve it as static files only.
- Add checks to the upload handler if you maintain the source: allow only the file types you need, check content as well as the name, and store files outside the web root under generated names.
- Review the upload directory for files that should not be there, and keep a copy for investigation before you delete anything.
- Rotate secrets stored on the server if you find signs of tampering.
Why it matters
The weakness is unrestricted file upload combined with weak access control. The application accepts a file through file without limiting what type it is or where it ends up. If the file lands somewhere the server runs code from, an upload becomes code execution.
The record scores the impact as low in each category and says the attack needs a low privileged account (PR:L in the vector). The real impact depends on your server configuration, which is why a quick look at the upload directory is the best first check.
The record maps this to CWE-284 (Improper Access Control), CWE-434 (Unrestricted Upload of File with Dangerous Type).
Quick check
Is CVE-2025-1818 exploited in the wild?
The record's CISA KEV flag is false, and nothing in the record says attacks are underway. It does say the exploit has been disclosed to the public.
Is there a fix for zj1983 zz?
The CVE record names no fixed version. Check the vendor or project page, and limit access to the affected path until you have one.
Sources
- Safeguard Gold entry for CVE-2025-1818
- CVE record data as supplied for this review (NVD description, CVSS vector, CWE list). The references below are listed in the record and were not all fetched for this page, so confirm details against the vendor before acting.
- https://vuldb.com/?ctiid.298091
- https://vuldb.com/?id.298091
- https://vuldb.com/?submit.504304
- https://www.yuque.com/u123456789-6sobi/cdgcbq/bg2g3eit41o4cpd4
- https://www.yuque.com/u123456789-6sobi/cdgcbq/bg2g3eit41o4cpd4#
Last reviewed: 19 October 2026.
