CVE-2025-15499 | Sangfor Operation and Maintenance Management System up to 3.0.8 VersionController.java uploadCN filename os command injection

January 9, 2026 Yanac

A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8 and classified as critical. This vulnerability affects the function uploadCN of the file VersionController.java. The manipulation of the argument filename leads to os command injection.

This vulnerability is listed as CVE-2025-15499. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More