CVE-2026-2672

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2672", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-18T09:24:14.020Z", "datePublished": "2026-02-18T21:32:07.412Z", "dateUpdated": "2026-02-23T10:25:29.097Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:25:29.097Z"}, "title": "Tsinghua Unigroup Electronic Archives System downLoad download path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "Tsinghua Unigroup", "product": "Electronic Archives System", "versions": [{"version": "3.2.210802(62532)", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function Download of the file /Search/Subject/downLoad. Performing a manipulation of the argument path results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-18T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-18T10:29:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "lanmeik (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346468", "name": "VDB-346468 | Tsinghua Unigroup Electronic Archives System downLoad download path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346468", "name": "VDB-346468 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753295", "name": "Submit #753295 | Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) File and Directory Information Exposure", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.753383", "name": "Submit #753383 | Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) File and Directory Information Exposure (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/introduce", "tags": ["broken-link"]}, {"url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/poc.py", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T15:02:16.190742Z", "id": "CVE-2026-2672", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T15:03:03.632Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2672", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T15:02:16.190742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T15:02:58.938Z"}}], "cna": {"title": "Tsinghua Unigroup Electronic Archives System downLoad download path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "lanmeik (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Tsinghua Unigroup", "product": "Electronic Archives System", "versions": [{"status": "affected", "version": "3.2.210802(62532)"}]}], "timeline": [{"lang": "en", "time": "2026-02-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-18T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-18T10:29:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346468", "name": "VDB-346468 | Tsinghua Unigroup Electronic Archives System downLoad download path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346468", "name": "VDB-346468 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753295", "name": "Submit #753295 | Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) File and Directory Information Exposure", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.753383", "name": "Submit #753383 | Tsinghua Unigroup Electronic Archives System 3.2.210802(62532) File and Directory Information Exposure (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/introduce", "tags": ["broken-link"]}, {"url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/poc.py", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function Download of the file /Search/Subject/downLoad. Performing a manipulation of the argument path results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:25:29.097Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2672", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:25:29.097Z", "dateReserved": "2026-02-18T09:24:14.020Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-18T21:32:07.412Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Electronic Archives System", "vendor": "Tsinghua Unigroup", "versions": [{"status": "affected", "version": "3.2.210802(62532)"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unigroup:electronic_archives_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "830E63B2-7C13-41AF-9605-E69078638FC8", "versionEndIncluding": "3.2.210802\\(62532\\)", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function Download of the file /Search/Subject/downLoad. Performing a manipulation of the argument path results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una falla de seguridad en el Sistema de Archivos Electr\u00f3nicos Tsinghua Unigroup 3.2.210802(62532). Est\u00e1 afectada por esta vulnerabilidad la funci\u00f3n Download del archivo /Search/Subject/downLoad. La manipulaci\u00f3n del argumento path provoca un salto de ruta. El ataque puede llevarse a cabo de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques. Se contact\u00f3 pronto con el proveedor sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2672", "lastModified": "2026-06-17T10:31:30.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2672", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T15:02:16.190742Z", "version": "2.0.3"}}]}, "published": "2026-02-18T22:16:27.553", "references": [{"source": "cna@vuldb.com", "tags": ["Broken Link"], "url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/introduce"}, {"source": "cna@vuldb.com", "tags": ["Broken Link"], "url": "https://github.com/luoye197-prog/cve-ziguang-fileread/blob/main/poc.py"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.346468"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.346468"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.753295"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.753383"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.210802(62532)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Electronic Archives System", "source": "cna", "vendor": "Tsinghua Unigroup"}, "product": "electronic_archives_system", "vendor": "tsinghua_unigroup"}], "analysis": {"en": {"generated_at": "2026-04-17T18:26:42.635911+00:00", "value": {"mitigation_remediation": ["Apply the latest vendor patch or upgrade to a fixed version of the Electronic Archives System", "Restrict filesystem permissions for the web server so that the download directory cannot access sensitive directories", "Validate and sanitize all user-supplied path parameters before file access"], "summary": {"action": "Patch", "impact": "Unauthorized file access via path traversal"}, "threat_synthesis": {"affected_systems": "The affected product is Tsinghua Unigroup's Electronic Archives System, specifically the Download feature in version 3.2.210802(62532). No other vendors or versions are known to be impacted.", "description_and_impact": "A vulnerability exists in the Download function of Tsinghua Unigroup Electronic Archives System version 3.2.210802(62532). Manipulating the path parameter of the /Search/Subject/downLoad endpoint allows an attacker to access files outside the intended directory, effectively leaking sensitive data. The weakness is a classic path traversal flaw (CWE-22), which can compromise confidentiality and potentially expose system files or configuration data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests exploit probability is low at this moment. It is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely; the attacker need only send a crafted request to the vulnerable endpoint, which is publicly available. Since an exploit has already been released, there is a credible risk of an attacker using the publicly available proof\u2011of\u2011concept to gain unauthorized file access."}}}}, "created": "2026-02-19T10:10:57.525523+00:00", "updated": "2026-04-17T18:30:05.658573+00:00", "vendors": ["tsinghua_unigroup", "tsinghua_unigroup$PRODUCT$electronic_archives_system"]}