CVE-2025-11140 is a high severity (7.3) XML external entity flaw in Bjskzy Zhiyou ERP up to 11.0. Crafted XML input is processed through the openForm function of the RichClientService component, through the contentString argument. The record lists no fixed version, so limit access, parse XML with external entities disabled, and check with the vendor.
What's affected
The record lists Bjskzy Zhiyou ERP up to 11.0. The affected function is openForm in the component com.artery.richclient.RichClientService, through the contentString argument. The record says the vendor was contacted early and did not respond. CVSS 7.3 (high severity), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Fixed versions: none are named in the record.
How to check if you're exposed
First find out whether you run it at all. Search your asset list, container images and web roots for Bjskzy Zhiyou ERP. On a Linux host you can look for the vulnerable file name directly.
find / -name "openForm" -not -path "/proc/*" 2>/dev/null
Check request logs for the affected path, and watch for outbound connections from the server to hosts it should not talk to, since XXE is often used to make a server fetch things. Egress logs from the host or firewall are the quickest source.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Limit access to the service to trusted networks.
- Ask the vendor for a fixed release and for written confirmation of status.
- Block outbound connections from the server except to hosts it needs. This limits what an XXE read can send out.
- If you maintain the code, turn off external entity and DTD processing in the XML parser.
- Review logs on the affected path for unusual request bodies and sizes.
Why it matters
The record classes this as CWE-610 (externally controlled reference), CWE-611 (XML external entity reference). XML allows documents to point at external resources. If the parser follows those pointers on input from outside, an attacker can make the server read local files or contact other systems.
Safe parser settings that disable external entities remove this class of bug. The record says exploit details are public and does not mark it as on the CISA KEV list.
Quick check
Is there a patched version?
The CVE record names none. Ask the vendor and limit network access in the meantime.
How is XXE prevented?
Disable external entity and DTD processing in the XML parser. Most libraries have a setting for this.
Sources
Last reviewed: 19 October 2026.
