CVE-2025-3381 is a Medium (CVSS 6.3) path traversal in the file upload code of zhangyanbo2007 youkefu 4.2.0, in WebIMController.java. The ID argument is the vector. No fixed version is named in the record, so check the project and restrict uploads.
What's affected
The record names one product and version: zhangyanbo2007 youkefu 4.2.0, an open source customer service and live chat system written in Java. The affected component is File Upload, and the file named is WebIMController.java. The argument is ID.
The vector shows low privileges required and a network attack path, so a signed in user, which in a chat product can include a visitor session, could reach it. The description states that an exploit has been disclosed to the public and may be used. The record's KEV flag is false, so it is not on the CISA Known Exploited Vulnerabilities list.
No fixed version is named. The reference list points to a write up by a researcher on GitHub, and a VulDB entry. I could not load the write up when reviewing, so check the project repository for releases and issues before you rely on this summary.
How to check if you're exposed
- Confirm which release of youkefu you run. Look at your deployment record or the build artifact version. Only 4.2.0 is named in the record.
- Check the project for the controller named in the record and read how it uses the
IDvalue when it builds a path for an uploaded file. - Look at where the application stores uploads, and which operating system account it runs as. A flaw that writes outside the upload folder matters more if that account can write to application code.
- Check your reverse proxy or web server logs for upload requests with unusual
IDvalues. - Review the upload directory and its parent folders for files that should not be there.
- Run the free in-browser dependency scan on the project's build file for its libraries. It will not review this controller's own logic.
What to do now
- Look for a newer youkefu release or a commit that addresses the issue, and read its notes before upgrading.
- Until you have a fix, limit who can reach the upload feature. Put the application behind authentication or an IP allowlist where the business allows it.
- Make the application account unable to write outside the upload folder, and keep that folder separate from any code or configuration.
- In the code, do not build file paths from request values. Generate server side names, and check that the resolved path stays inside the intended directory.
- Review the file system for unexpected files and the logs for unusual uploads.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory, commonly called path traversal. A value from the request ends up in a file path, and special sequences let the path point somewhere the developer did not intend. In an upload feature, that can mean files stored in the wrong place, or existing files overwritten.
The effect depends on where the application runs and what it may write. The score is Medium because the record rates impact low on confidentiality, integrity and availability. A customer service platform handles real conversations, so an unmaintained deployment on the public internet is worth a review even at this score.
Quick check
Is this exploited in the wild?
The record says an exploit has been disclosed to the public, but its KEV flag is false, so it is not on the CISA Known Exploited Vulnerabilities list. No advisory I could fetch says it is exploited.
Sources
- Gold vulnerability page for CVE-2025-3381
- The reference list in the NVD record, which points to a researcher write up and a VulDB entry. Neither could be retrieved when reviewed, so no fixed version is confirmed.
Last reviewed: 18 October 2026.
