PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-70060 Ymfe CVE debrief

CVE-2025-70060 is a medium-severity web application vulnerability mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation) in YMFE yapi 1.12.0. The NVD record lists a CVSS 3.1 score of 5.4 with network attack vector, low attack complexity, no privileges required, and user interaction required. The cited impact is limited to low confidentiality and integrity, with no availability impact noted. Because the source record does not include a fixed version or remediation details, the safest interpretation is that operators of the affected yapi release should treat this as an XSS-class issue and follow vendor or upstream guidance before exposing the application to untrusted input or broad user access.

Vendor
Ymfe
Product
Yapi
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-09
Original CVE updated
2026-05-10
Advisory published
2026-03-09
Advisory updated
2026-05-10

Who should care

Administrators, developers, and security teams responsible for YMFE yapi 1.12.0 deployments should review this issue. It is especially relevant where yapi is used by multiple users, exposed over the network, or processes user-supplied content in web pages.

Technical summary

The official NVD data ties CVE-2025-70060 to cpe:2.3:a:ymfe:yapi:1.12.0 and CWE-79. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating a remotely reachable flaw that depends on user interaction and can affect confidentiality and integrity at a low level. The source corpus does not provide a proof of concept, exploit chain, affected endpoint details, or a confirmed patched release.

Defensive priority

Medium. The issue is publicly documented and remotely reachable, but the available record suggests limited impact and requires user interaction. Prioritize it for web-facing yapi deployments and environments that accept untrusted input.

Recommended defensive actions

  • Review the NVD and linked advisory/reference material for the latest remediation guidance.
  • Determine whether any deployed instance is running YMFE yapi 1.12.0 and inventory exposed instances.
  • Limit exposure of yapi to trusted networks and authenticated users until remediation is confirmed.
  • Apply the vendor or upstream fix once a patched release is identified in official guidance.
  • Validate any user-controlled content handling and review web-page generation paths for XSS hardening.

Evidence notes

Evidence in the supplied corpus comes from the official NVD modified record for CVE-2025-70060, which lists affected CPE cpe:2.3:a:ymfe:yapi:1.12.0:*:*:*:*:*:*:*, CWE-79 as the primary weakness, and CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The record also includes references to a third-party advisory gist and the YMFE GitHub organization/project pages. No exploit details, affected component subpaths, or fixed-version information are present in the supplied source item.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-70060 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-70060

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-70060 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-70060

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.