Seeyon OA A8 Unauth Arbitrary File Write via /htmlofficeservlet (v6.1sp1+)
CVE-2019-25714 Published on April 21, 2026
Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC).
Vulnerability Analysis
CVE-2019-25714 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Unrestricted File Upload Vulnerability?
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CVE-2019-25714 has been classified to as an Unrestricted File Upload vulnerability or weakness.
Products Associated with CVE-2019-25714
Want to know whenever a new CVE is published for IBM Collaborative Lifecycle Management? stack.watch will email you.
Affected Versions
Seeyon Internet Software A8-V5 Collaborative Management Software:- Version 6.1sp1 is affected.
- Version 7.0 is affected.
- Version 7.0sp1 is affected.
- Version 7.0sp2 is affected.
- Version 7.0sp3 is affected.
- Version 7.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.