CVE-2023-54403 — Path Traversal in Yonyou U8 CRM

Vendor	Product	Version range	Fixed in
yonyou	u8_crm	—	—
yonyou	u8_crm	—	—
yonyou	u8_crm	—	—
yonyou	u8_crm	—	—

GHSA

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 par

ghsa_unreviewed·2026-09-30

CVE-2023-54403 [HIGH] CWE-22 Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 par Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

VulDB

Yonyou U8 CRM up to 17 /ajax/getemaildata.php filePath path traversal

vuldb·2026-09-30·CVSS 7.5

CVE-2023-54403 [HIGH] Yonyou U8 CRM up to 17 /ajax/getemaildata.php filePath path traversal A vulnerability was found in Yonyou U8 CRM up to 17 and classified as problematic. This impacts an unknown function of the file /ajax/getemaildata.php. Such manipulation of the argument filePath leads to path traversal. This vulnerability is listed as CVE-2023-54403. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

VulnCheck

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

vulncheck·2023·CVSS 7.5

CVE-2023-54403 [HIGH] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14. Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Exploitation References: https://ww

CVE-2023-54403: Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass…

Affected

CVSS provenance