References https://github.com/0day404/HV-2024-POC/blob/main/%E7%94%A8%E5%8F%8BU8-Cloud%20upload%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E7%94%A8%E5%8F%8B-U8-cloud-upload.jsp-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md https://www.cnblogs.com/Domren/articles/19242469 https://github.com/adeljck/YongYou-Exploit https://dev.to/sharon_42e16b8da44dabde6d/critical-file-upload-vulnerability-in-yonyou-u8-cloud-ipfxxfileservice-22k1 https://www.cnblogs.com/pa0fu/p/18269408 https://cn-sec.com/archives/4921912.html https://www.siukwai.com/archives/gNVjbOoL https://comate.baidu.com/zh/page/g2tn5f7u8qi https://www.zbysec.com/?mod=news_detail&id=112
Related VulnerabilitiesPoCCVE-2026-21589: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File ReadPoCCVE-2026-29058: WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command InjectionPoC用友NC /ebvp/infopub/showcontent SQL 注入漏洞关于U9 cloud存在命令执行漏洞的安全通告关于U9 cloud存在接口反序列化漏洞的安全通告PoCCVE-2026-58467: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion关于NC系统的文件控制台SQL注入漏洞的安全通告PoCCVE-2026-9103: Langflow OSS - Superuser Token Issuance金蝶eascloud管理控制端任意文件上传PoCCVE-2026-18072: Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication BypassPoCCVE-2026-27960: OpenCTI < 6.9.13 - Authentication Bypass via User ImpersonationPoCarangodb-auth-bypass: ArangoDB - Authentication Bypass via URL-Encoded Underscore (%5f) to RCEPoCCVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation