References https://github.com/zan8in/pocwiki/blob/main/%E7%94%A8%E5%8F%8BNC%E7%9A%84download%E6%96%87%E4%BB%B6%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md https://www.cnblogs.com/pursue-security/p/17764545.html https://cn-sec.com/archives/2232588.html https://github.com/admin772/POC/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BNC%E7%9A%84download%E6%96%87%E4%BB%B6%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md https://www.lmboke.com/archives/yong-you-nc-downcoursewareren-yi-wen-jian-du-qu https://cn-sec.com/archives/2191124.html https://github.com/j2ekim/YonyouNC_Tip https://mrxn.net/jswz/yonyou-u8cloud-console-loadRes-fileread.html
Related VulnerabilitiesPoCCVE-2025-66744: Yonyou YonBIP - Path TraversalPoCyonyou-u9-patchfile-upload: Yonyou U9 PatchFile.asmx - Unauthenticated Arbitrary File Uploadcellinxnvt-getfilecontent-cgi-fileread: Cellinx NVT - GetFileContent.cgi - FileReadeaa-fileread: EAA 益和应用接入系统任意文件读取esafenet-sql-mysql-fileread: 亿赛通未授权文件下载huatiandongli-ntkodownload-fileread: 华天动力 ntkoDownload 任意文件读取huatiandongli-templateservice-fileread: 华天动力 ntkoDownload 任意文件读取huijietong-cloud-fileread: Huijietong Cloud File Readsangfor-reporter-anyfileread: Sangfor reporter 任意文件读取yonyou-grp-u8-logs-disclosure: 用友 GRP-U8 管理平台 logs 敏感信息泄露yonyou-nc-arbitrary-file-upload: Yonyou NC Arbitrary file uploadyonyou-nc-monitorservlet-rce: Yonyou NC monitors servlet RCEyonyou-nc-ncmessageservlet-rce: Yonyou NC messages servlet RCE