CVE-2025-3241 is a medium severity (CVSS 6.3) XML external entity flaw in zhangyanbo2007 youkefu up to version 4.2.0. The call center router controller parses XML unsafely. The record lists no fixed version, so restrict the admin area and harden the XML parser.
What's affected
The NVD record covers youkefu up to 4.2.0. The file named is src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java, in the XML document handler component, and the argument is routercontent. The weakness classes are CWE-611 (improper restriction of XML external entity reference) and CWE-610 (externally controlled reference to a resource in another sphere).
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so a low privilege account is needed and each impact is rated low. The record says the exploit has been disclosed publicly. The KEV flag is false, and nothing reviewed reports attacks.
The record does not list a fixed version. I could not confirm a patch, so the project's repository and releases should be checked directly.
How to check if you're exposed
- Find out which youkefu version you run. If you built from source, check the commit and the project's version file.
- Confirm whether the call center module and its router configuration screen are enabled.
- Find the parser. Search the source for the controller and see how the
routercontentvalue is turned into an XML document.
grep -rn "routercontent" src/main/java | head
grep -rn "DocumentBuilderFactory\|SAXReader\|XMLInputFactory" src/main/java | head
- Check whether the parser disables DTDs and external entities. Without that, the XXE class applies.
What to do now
- Check the project repository for a release newer than 4.2.0 and a commit that mentions this issue.
- Disable DTD processing and external entity resolution in every XML parser the application uses. For Java parsers this is a factory setting, documented in the OWASP XXE cheat sheet.
- Restrict the admin area to trusted networks and accounts.
- Block outbound connections from the application server except where it needs them, since XXE can be used to make the server fetch resources.
- Review other places that accept XML in the same codebase.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
XML allows a document to refer to external resources. A parser that follows those references on untrusted input can be made to read local files or contact internal addresses. The behaviour is a feature of the format, which is why the fix is in parser configuration and not in the data.
The rating is medium because a login is required and the impact numbers are low. Still, call center software holds customer data, and an admin screen that accepts XML is exactly the sort of place where that setting gets forgotten.
Quick check
Is there a patch for youkefu?
The record lists no fixed version. Check the project repository and its releases.
What is the quickest mitigation?
Turn off DTDs and external entities in the XML parser, and limit who can reach the admin page.
Sources
Last reviewed: 19 October 2026.
