CVE-2025-15098: YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery
A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15098?
CVE-2025-15098 is classified with a high severity rating due to the potential for server-side request forgery.
How do I fix CVE-2025-15098?
To fix CVE-2025-15098, update YunaiV yudao-cloud to a version later than 2025.11.
What components are affected by CVE-2025-15098?
CVE-2025-15098 affects the Business Process Management component, specifically the BpmHttpCallbackTrigger and BpmSyncHttpRequestTrigger functions.
What kind of attacks can be executed due to CVE-2025-15098?
Exploitation of CVE-2025-15098 can lead to server-side request forgery attacks, allowing an attacker to interact with internal services.
Is my application vulnerable to CVE-2025-15098?
If you are using YunaiV yudao-cloud version 2025.11 or earlier, your application is vulnerable to CVE-2025-15098.