An unauthenticated attacker can bypass authentication in Yonyou U8 CRM by setting DontCheckLogin=1 in the AJAX endpoint /ajax/getemaildata.php. The filePath parameter is not validated, allowing the attacker to read any file on the server. This flaw can expose configuration files, database credentials, and other sensitive data. The vulnerability is a classic local file inclusion that can lead to broad information disclosure.

The flaw exists in Yonyou U8 CRM versions prior to V16.5 and V18. Users running these releases are vulnerable until an official update is applied.

The CVSS score of 8.7 indicates a high severity. No EPSS score is available, so the exploitation probability cannot be quantified precisely, but the existence of a publicly known and documented exploit suggests that attackers could actively use it in the field. The vulnerability is not listed in the CISA KEV catalog, but the observed exploitation dates back to October 2023, indicating real-world activity. The attack vector is unauthenticated, as the flaw can be triggered without valid credentials, making it especially dangerous for exposed systems.