VulnerabilityAnalyzed
CVE-2026-1549
A vulnerability was identified in jishenghua jshERP up to 3.6.
LOW 2.1EPSS 0.47%
Does this matter?
Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.47% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- jishenghua/jsherp
- Source
- cna@vuldb.com
References
- https://github.com/jishenghua/jshERP/Product
- https://github.com/jishenghua/jshERP/issues/146Exploit, Issue Tracking
- https://github.com/jishenghua/jshERP/issues/146#issue-3817997461Exploit, Issue Tracking
- https://vuldb.com/?ctiid.343245Permissions Required, VDB Entry
- https://vuldb.com/?id.343245Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.739805Third Party Advisory, VDB Entry
- https://github.com/jishenghua/jshERP/issues/146Exploit, Issue Tracking
- https://github.com/jishenghua/jshERP/issues/146#issue-3817997461Exploit, Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.