TVN ID	TVN-202512009
CVE ID	CVE-2025-15227, CVE-2025-15228
CVSS	CVE-2025-15227： 7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2025-15228： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products	BPMFlowWebkit version before 5.0.5
Description	CVE-2025-15227： BPMFlowWebkit has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files. CVE-2025-15228： BPMFlowWebkit has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Solution	Update to version 5.0.5 or later.
Credit	Alan Chung, Xin Yu Lin(DEVCORE)
Public Date	2025-12-29