CVE-2026-1549

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1549", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-28T16:53:00.932Z", "datePublished": "2026-01-28T23:02:07.452Z", "dateUpdated": "2026-02-23T09:02:48.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:02:48.663Z"}, "title": "jishenghua jshERP PluginController uploadPluginConfigFile path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "jishenghua", "product": "jshERP", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}], "cpes": ["cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*"], "modules": ["PluginController"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-28T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-29T12:57:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "mukyuuhate (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343245", "name": "VDB-343245 | jishenghua jshERP PluginController uploadPluginConfigFile path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343245", "name": "VDB-343245 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.739805", "name": "Submit #739805 | https://github.com/jishenghua/jshERP jshERP v3.6 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146", "tags": ["issue-tracking"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/jishenghua/jshERP/", "tags": ["product"]}]}, "adp": [{"references": [{"url": "https://github.com/jishenghua/jshERP/issues/146", "tags": ["exploit"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T15:58:46.085975Z", "id": "CVE-2026-1549", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:53:53.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1549", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T15:58:46.085975Z"}}}], "references": [{"url": "https://github.com/jishenghua/jshERP/issues/146", "tags": ["exploit"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T15:58:48.897Z"}}], "cna": {"title": "jishenghua jshERP PluginController uploadPluginConfigFile path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "mukyuuhate (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*"], "vendor": "jishenghua", "modules": ["PluginController"], "product": "jshERP", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}]}], "timeline": [{"lang": "en", "time": "2026-01-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-28T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-29T12:57:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343245", "name": "VDB-343245 | jishenghua jshERP PluginController uploadPluginConfigFile path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343245", "name": "VDB-343245 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.739805", "name": "Submit #739805 | https://github.com/jishenghua/jshERP jshERP v3.6 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146", "tags": ["issue-tracking"]}, {"url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/jishenghua/jshERP/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:02:48.663Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1549", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:02:48.663Z", "dateReserved": "2026-01-28T16:53:00.932Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-28T23:02:07.452Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*"], "modules": ["PluginController"], "product": "jshERP", "vendor": "jishenghua", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2371BC75-D648-47F9-8B86-49CD53FB4DD4", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en jishenghua jshERP hasta la versi\u00f3n 3.6. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /jshERP-boot/plugin/uploadPluginConfigFile del componente PluginController. Dicha manipulaci\u00f3n del argumento configFile conduce a un salto de ruta. El ataque puede ser lanzado remotamente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "id": "CVE-2026-1549", "lastModified": "2026-06-17T10:16:03.073", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1549", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T15:58:46.085975Z", "version": "2.0.3"}}]}, "published": "2026-01-28T23:15:50.870", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/jishenghua/jshERP/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/jishenghua/jshERP/issues/146"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.343245"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.343245"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.739805"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/jishenghua/jshERP/issues/146"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/jishenghua/jshERP/issues/146#issue-3817997461"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:33:21.549935+00:00", "value": {"mitigation_remediation": ["Upgrade jshERP to the latest release that removes the path traversal issue or apply the official patch if released.", "Restrict access to the uploadPluginConfigFile endpoint to only authenticated and authorized administrative users.", "Validate all user-supplied file paths on the server side, ensuring that the configFile value does not contain '..' or URL-encoded directory separators, and that it resolves within a designated safe directory.", "Deploy a Web Application Firewall (WAF) rule that detects and blocks path traversal patterns targeting the uploadPluginConfigFile endpoint."], "summary": {"action": "Patch ASAP", "impact": "Remote Path Traversal"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of jshERP from the vendor Jishenghua up to version\u00a03.6. The product is hosted at jishenghua/jshERP on GitHub. No higher versions have been identified in the data, so any deployment of version\u00a03.6 or earlier is potentially vulnerable.", "description_and_impact": "The PluginController in jshERP includes an uploadPluginConfigFile function that accepts a configFile argument. The current implementation does not sanitize this parameter, resulting in a path traversal flaw. An attacker can supply crafted values for configFile, causing the application to resolve file paths outside of the intended directory structure. This flaw enables remote attackers to read arbitrary files or, depending on the server configuration, write files that could be executed or used in further attacks.", "risk_and_exploitability": "The CVSS base score is\u00a05.3 indicating moderate severity, and the EPSS score is below\u00a01%, suggesting a low probability of exploitation under current threat landscapes. However, the vulnerability is publicly documented, and an exploit is available. Attackers can invoke the flaw remotely by sending a crafted HTTP request to the /jshERP-boot/plugin/uploadPluginConfigFile endpoint using the configFile parameter. Because the flaw does not require local privileges, the impact can affect confidentiality and integrity of files on the server."}}}}, "created": "2026-01-29T09:09:02.305575+00:00", "updated": "2026-04-18T01:45:33.391288+00:00", "vendors": ["jishenghua", "jishenghua$PRODUCT$jsherp"]}