CVE-2026-2864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2864", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-20T14:17:49.093Z", "datePublished": "2026-02-21T07:32:07.446Z", "dateUpdated": "2026-02-23T19:41:53.728Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T07:32:07.446Z"}, "title": "feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "feng_ha_ha", "product": "ssm-erp", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "feng_ha_ha", "product": "production_ssm", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "megagao", "product": "ssm-erp", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "megagao", "product": "production_ssm", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T15:22:56.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Jszdk (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347103", "name": "VDB-347103 | feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347103", "name": "VDB-347103 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.754557", "name": "Submit #754557 | https://github.com/megagao/production_ssm production_ssm v1.0 Arbitrary file deletion vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/megagao/production_ssm/issues/38", "tags": ["issue-tracking"]}, {"url": "https://github.com/megagao/production_ssm/issues/38#issue-3915113401", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:41:38.148045Z", "id": "CVE-2026-2864", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:41:53.728Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2864", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:41:38.148045Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:41:47.684Z"}}], "cna": {"title": "feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Jszdk (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "feng_ha_ha", "product": "ssm-erp", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "feng_ha_ha", "product": "production_ssm", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "megagao", "product": "ssm-erp", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "megagao", "product": "production_ssm", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T15:22:56.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347103", "name": "VDB-347103 | feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347103", "name": "VDB-347103 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.754557", "name": "Submit #754557 | https://github.com/megagao/production_ssm production_ssm v1.0 Arbitrary file deletion vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/megagao/production_ssm/issues/38", "tags": ["issue-tracking"]}, {"url": "https://github.com/megagao/production_ssm/issues/38#issue-3915113401", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T07:32:07.446Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2864", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:41:53.728Z", "dateReserved": "2026-02-20T14:17:49.093Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-21T07:32:07.446Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ssm-erp", "vendor": "feng_ha_ha", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "production_ssm", "vendor": "feng_ha_ha", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "ssm-erp", "vendor": "megagao", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "production_ssm", "vendor": "megagao", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en feng_ha_ha/megagao ssm-erp y production_ssm hasta 4288d53bd35757b27f2d070057aefb2c07bdd097. Esto afecta a la funci\u00f3n pictureDelete del archivo PictureController.java. Dicha manipulaci\u00f3n del argumento picName conduce a salto de ruta. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. Este producto no utiliza versionado. Por esta raz\u00f3n, la informaci\u00f3n sobre las versiones afectadas y no afectadas no est\u00e1 disponible. Este producto se distribuye bajo dos nombres completamente diferentes. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "id": "CVE-2026-2864", "lastModified": "2026-06-17T10:31:54.743", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2864", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:41:38.148045Z", "version": "2.0.3"}}]}, "published": "2026-02-21T08:16:12.377", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/megagao/production_ssm/issues/38"}, {"source": "cna@vuldb.com", "url": "https://github.com/megagao/production_ssm/issues/38#issue-3915113401"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347103"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347103"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.754557"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4288d53bd35757b27f2d070057aefb2c07bdd097"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "production_ssm", "source": "cna", "vendor": "feng_ha_ha"}, "product": "production_ssm", "vendor": "megagao"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4288d53bd35757b27f2d070057aefb2c07bdd097"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ssm-erp", "source": "cna", "vendor": "megagao"}, "product": "ssm-erp", "vendor": "megagao"}], "analysis": {"en": {"generated_at": "2026-04-18T17:50:33.856195+00:00", "value": {"mitigation_remediation": ["Update the application to the latest commit or apply an official patch that corrects the path traversal in pictureDelete.", "Ensure that the directory used for storing images has permissions limited to the web process so that the process cannot read or write other files on the system.", "Validate the picName parameter on the server side, rejecting any values that contain relative paths, \"..\", or other sequences that could cause directory traversal, and verify that the resolved path remains within the designated image directory."], "summary": {"action": "Apply Patch", "impact": "Path Traversal"}, "threat_synthesis": {"affected_systems": "Affected vendors include feng_ha_ha and megagao, each offering the production_ssm and ssm\u2011erp products. The path traversal flaw exists in all releases up to commit 4288d53bd35757b27f2d070057aefb2c07bdd097. Since the project does not use traditional versioning, no specific version numbers are available, and the flaw is only identified by the commit hash. The application is distributed under two separate project names.", "description_and_impact": "The CVE-2026-2864 vulnerability arises from a path traversal flaw in the pictureDelete function of PictureController.java. The flaw is triggered when an attacker supplies a specially crafted picName argument, causing the application to resolve a file path that escapes the intended directory. Because the vulnerability is exploitable remotely through a standard HTTP request, an attacker with network access to the service can attempt to influence the file path used for deletion. The weakness is a classic example of CWE\u201122, whereby the application fails to properly constrain the file system locations it accesses.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating a medium severity issue. The EPSS score is below 1\u202f%, suggesting a low likelihood of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires only network connectivity to the application\u2019s endpoint and the ability to send a crafted picName value. The fact that the exploit has been publicly disclosed implies knowledge of the vulnerability, but no official patch or workaround has yet been released. Until corrective action is taken, the risk remains, particularly if the application is exposed to untrusted users."}}}}, "created": "2026-02-23T14:32:20.900727+00:00", "updated": "2026-04-18T18:00:06.455649+00:00", "vendors": ["megagao", "megagao$PRODUCT$production_ssm", "megagao$PRODUCT$ssm-erp"]}