轉發 台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000008
[內容說明]
【葳橋資訊｜簽章服務(BatchSignCS) - Arbitrary File Write through Path Traversal】(CVE-2025-7619，CVSS：8.8) 葳橋資訊開發之簽章服務(BatchSignCS)為Windows背景程式，其存在Arbitrary File Write漏洞，在該程式開啟的情況下，使用者若瀏覽惡意網站，遠端攻擊者便可寫入任意檔案至任意路徑，並有機會利用此漏洞執行任意程式碼。
[影響平台]
簽章服務(BatchSignCS) 3.138(含)以前版本
[建議措施]
更新至3.145(含)以後版本
[參考資料]
https://www.twcert.org.tw/tw/cp-132-10239-770ab-1.html
Forwarded by Taiwan Computer Network Crisis Management and Coordination Center TWCERTCC-200-202507-00000008
[Content Description]
[WellChoose Information｜BatchSignCS - Arbitrary File Write through Path Traversal] (CVE-2025-7619, CVSS: 8.8) The BatchSignCS developed by WellChoose Information is a Windows background program. It has an Arbitrary File Write vulnerability. When the program is turned on, if the user browses a malicious website, a remote attacker can write any file to any path and have the opportunity to use this vulnerability to execute arbitrary code.
[Affected Platform]
Signing Service (BatchSignCS) 3.138 (inclusive) and earlier versions
[Suggested Measures]
Update to 3.145 (inclusive) and later versions
[References]
https://www.twcert.org.tw/tw/cp-132-10239-770ab-1.html