Description
A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml external entity reference. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via XML External Entity
Action: Mitigate
AI Analysis

Impact

The flaw is in the initRCForm method of the RichClientService component, where XML input is parsed without restricting external entity resolution. An attacker can supply crafted XML that forces the server to read internal files or reach out to arbitrary network destinations, exposing confidential data. Based on the description, it is inferred that this could enable server‑side request forgery. This weakness is classified as CWE‑610 and CWE‑611.

Affected Systems

Vendor Bjskzy’s Zhiyou ERP versions 11.0 and earlier are vulnerable. The issue resides in com.artery.richclient.RichClientService and affects any deployment that uses the initRCForm RPC endpoint.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of exploitation in the near future. The flaw is not listed in the CISA KEV catalog. The attack vector is remote, requiring only the ability to send XML data to the RichClientService interface; no authentication or privileged access is explicitly mentioned in the description.

Generated by OpenCVE AI on April 18, 2026 at 19:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Configure the XML parser to disallow external entity resolution, such as disabling DOCTYPE declarations or providing a null entity resolver.
  • Limit access to the RichClientService endpoint to trusted hosts only and monitor for unusual XML payloads or attempts to resolve external entities.
  • Apply a vendor update or patch as soon as one is released that mitigates the XXE flaw in RichClientService.

Generated by OpenCVE AI on April 18, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Bjskzy
Bjskzy zhiyou Erp
Vendors & Products Bjskzy
Bjskzy zhiyou Erp

Tue, 20 Jan 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml external entity reference. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference
Weaknesses CWE-610
CWE-611
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bjskzy Zhiyou Erp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:52:03.555Z

Reserved: 2026-01-19T23:19:20.859Z

Link: CVE-2026-1218

cve-icon Vulnrichment

Updated: 2026-01-20T20:22:38.929Z

cve-icon NVD

Status : Deferred

Published: 2026-01-20T06:16:00.797

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T19:15:10Z

Weaknesses