Yonyou U8 CRM: Unauthenticated arbitrary file read in getemaildata.php
Summary
Yonyou U8 CRM versions before V16.5 and V18 contain an arbitrary file read vulnerability in /ajax/getemaildata.php. An unauthenticated attacker can bypass the login check with the parameter DontCheckLogin=1 and read files outside the web directory via the unvalidated filePath parameter. Configuration files can expose database or service credentials. Exploitation evidence was first observed by Shadowserver on 2023-10-14.
Affected
- Yonyou U8 CRM before V16.5 and V18 (per CVE description)
- Sources conflict: the CNA record lists 16.1, 16.0, 15.1 and 13 as affected and 16.5 and 18 as unaffected. The exact affected set is unconfirmed pending vendor information.
Fixed in
- V16.5 and V18 (per CVE description)
- Patch packages and build numbers: Unknown. The vendor advisory could not be verified.
Workaround
- Unknown. No vendor-confirmed workaround found.
- Restrict external access to the U8 CRM web application and its /ajax/ paths until patched.
Exploitation
- Exploitation evidence first observed by Shadowserver on 2023-10-14 (CVE record).
- Listed in the VulnCheck KEV database. A CISA KEV listing is not confirmed. CISA SSVC lists exploitation as none.
- A public write-up and a Nuclei detection template exist.
Our recommendation
- Check whether U8 CRM is reachable from the internet and confirm the installed version.
- Upgrade to V16.5 or V18 once the vendor package is verified.
- Restrict external access until patched.
- Rotate database and service credentials stored in configuration files if exposure is possible or confirmed.
- Search web server logs for requests to getemaildata.php containing DontCheckLogin or filePath.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Yonyou security advisory 624 security.yonyou.com
- Nuclei detection template github.com
- PeiQi-WIKI-Book write-up github.com
- VulDB entry vuldb.com
- Strix CVE record www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:31.
Original description (NVD)
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
NVD references (5)
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8…
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/yonyou/yonyou-u8-crm-lfi.…
- https://security.yonyou.com/#/noticeInfo?id=624
- https://www.vulncheck.com/advisories/yonyou-u8-crm-arbitrary-file-read-via-getemaildata-php
- https://www.yonyou.com/Global/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.