CVE-2026-2665

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2665", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-18T08:56:57.505Z", "datePublished": "2026-02-18T20:02:07.555Z", "dateUpdated": "2026-02-23T10:19:40.333Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:19:40.333Z"}, "title": "huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "huanzi-qch", "product": "base-admin", "versions": [{"version": "57a8126bb3353a004f3c7722089e3b926ea83596", "status": "affected"}], "modules": ["JSP Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-18T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-18T10:02:02.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Jszdk (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346462", "name": "VDB-346462 | huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346462", "name": "VDB-346462 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753240", "name": "Submit #753240 | https://github.com/huanzi-qch/base-admin base-admin v1.0 Upload any file", "tags": ["third-party-advisory"]}, {"url": "https://github.com/huanzi-qch/base-admin/issues/38", "tags": ["issue-tracking"]}, {"url": "https://github.com/huanzi-qch/base-admin/issues/38#issue-3905100373", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/huanzi-qch/base-admin/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T20:37:14.448163Z", "id": "CVE-2026-2665", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:37:34.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2665", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T20:37:14.448163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:37:25.783Z"}}], "cna": {"title": "huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "Jszdk (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "huanzi-qch", "modules": ["JSP Parser"], "product": "base-admin", "versions": [{"status": "affected", "version": "57a8126bb3353a004f3c7722089e3b926ea83596"}]}], "timeline": [{"lang": "en", "time": "2026-02-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-18T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-18T10:02:02.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346462", "name": "VDB-346462 | huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346462", "name": "VDB-346462 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753240", "name": "Submit #753240 | https://github.com/huanzi-qch/base-admin base-admin v1.0 Upload any file", "tags": ["third-party-advisory"]}, {"url": "https://github.com/huanzi-qch/base-admin/issues/38", "tags": ["issue-tracking"]}, {"url": "https://github.com/huanzi-qch/base-admin/issues/38#issue-3905100373", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/huanzi-qch/base-admin/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:19:40.333Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2665", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:19:40.333Z", "dateReserved": "2026-02-18T08:56:57.505Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-18T20:02:07.555Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["JSP Parser"], "product": "base-admin", "vendor": "huanzi-qch", "versions": [{"status": "affected", "version": "57a8126bb3353a004f3c7722089e3b926ea83596"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en huanzi-qch base-admin hasta 57a8126bb3353a004f3c7722089e3b926ea83596. Est\u00e1 afectada la funci\u00f3n Upload del archivo SysFileController.java del componente JSP Parser. Si se manipula el argumento File se puede realizar una carga sin restricciones. El ataque puede ser iniciado en remoto. El exploit es ahora p\u00fablico y puede ser usado. Como este producto realiza lanzamientos continuos no hay detalle de las versiones de lanzamientos afectados ni actualizados disponibles. Se inform\u00f3 pronto al proyecto del problema a trav\u00e9s de un informe de problema pero no ha respondido a\u00fan."}], "id": "CVE-2026-2665", "lastModified": "2026-06-17T10:31:29.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2665", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T20:37:14.448163Z", "version": "2.0.3"}}]}, "published": "2026-02-18T20:18:37.110", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/huanzi-qch/base-admin/"}, {"source": "cna@vuldb.com", "url": "https://github.com/huanzi-qch/base-admin/issues/38"}, {"source": "cna@vuldb.com", "url": "https://github.com/huanzi-qch/base-admin/issues/38#issue-3905100373"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346462"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346462"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.753240"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "57a8126bb3353a004f3c7722089e3b926ea83596"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "base-admin", "source": "cna", "vendor": "huanzi-qch"}, "product": "base-admin", "vendor": "huanzi-qch"}], "analysis": {"en": {"generated_at": "2026-04-18T11:55:43.736144+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011supplied patch or updated release that contains the fix as soon as it becomes available.", "Implement server\u2011side validation to accept only the file types, extensions, and sizes that are explicitly allowed by the application.", "Store uploaded files outside the web root or in a protected directory and restrict web access to that directory.", "Monitor upload logs for anomalous activity and block known malicious IP addresses."], "summary": {"action": "Assess Impact", "impact": "Unrestricted File Upload"}, "threat_synthesis": {"affected_systems": "All builds of huanzi\u2011qch base\u2011admin that include the SysFileController component are potentially vulnerable. The project uses continuous delivery with rolling releases and no version information is available, so any deployment containing this component, regardless of its apparent revision, may be affected.", "description_and_impact": "A flaw in the SysFileController.upload method of huanzi\u2011qch base\u2011admin allows an attacker to upload any file because the implementation does not validate the File argument. The CVE description states that manipulating this argument can result in unrestricted upload, potentially allowing malicious files to be stored on the server.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the present time. The vulnerability is not listed in CISA KEV. An attacker can trigger the flaw remotely using crafted HTTP requests to the upload endpoint, and the exploit code is publicly available."}}}}, "created": "2026-02-19T10:11:21.832619+00:00", "updated": "2026-04-18T12:00:05.891333+00:00", "vendors": ["huanzi-qch", "huanzi-qch$PRODUCT$base-admin"]}