CVE-2025-5877: Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5877?
CVE-2025-5877 has been classified as problematic, indicating a significant risk to affected systems.
What functionality is affected by CVE-2025-5877?
CVE-2025-5877 affects the Document Upload Handler functionality in Feng Office 3.2.2.1.
How do I fix CVE-2025-5877?
To fix CVE-2025-5877, it is recommended to update to the latest version of Feng Office as soon as it is available.
What are the potential impacts of CVE-2025-5877?
The potential impacts of CVE-2025-5877 include unauthorized access and manipulation of uploaded documents.
Which version of Feng Office is impacted by CVE-2025-5877?
CVE-2025-5877 specifically affects Feng Office version 3.2.2.1.