CVE-2026-2953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2953", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-21T21:11:08.662Z", "datePublished": "2026-02-22T14:02:15.375Z", "dateUpdated": "2026-02-25T16:03:10.026Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T14:02:15.375Z"}, "title": "Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "Dromara", "product": "UJCMS", "versions": [{"version": "101.2", "status": "affected"}], "cpes": ["cpe:2.3:a:ujcms:ujcms:*:*:*:*:*:*:*:*"], "modules": ["Template Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-21T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-21T22:16:20.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Saul1213 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347319", "name": "VDB-347319 | Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347319", "name": "VDB-347319 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755215", "name": "Submit #755215 | ujcms 101.2 Recursive Deletion of Template Storage", "tags": ["third-party-advisory"]}, {"url": "https://www.yuque.com/la12138/pa2fpb/lxngf3d07uyd0nwp?singleDoc", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T16:02:56.136047Z", "id": "CVE-2026-2953", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:03:10.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2953", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T16:02:56.136047Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:03:03.482Z"}}], "cna": {"title": "Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Saul1213 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:ujcms:ujcms:*:*:*:*:*:*:*:*"], "vendor": "Dromara", "modules": ["Template Handler"], "product": "UJCMS", "versions": [{"status": "affected", "version": "101.2"}]}], "timeline": [{"lang": "en", "time": "2026-02-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-21T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-21T22:16:20.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347319", "name": "VDB-347319 | Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347319", "name": "VDB-347319 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755215", "name": "Submit #755215 | ujcms 101.2 Recursive Deletion of Template Storage", "tags": ["third-party-advisory"]}, {"url": "https://www.yuque.com/la12138/pa2fpb/lxngf3d07uyd0nwp?singleDoc", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T14:02:15.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2953", "state": "PUBLISHED", "dateUpdated": "2026-02-25T16:03:10.026Z", "dateReserved": "2026-02-21T21:11:08.662Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-22T14:02:15.375Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ujcms:ujcms:*:*:*:*:*:*:*:*"], "modules": ["Template Handler"], "product": "UJCMS", "vendor": "Dromara", "versions": [{"status": "affected", "version": "101.2"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ujcms:ujcms:10.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E7F5B499-8E12-4636-A3F9-1600D7877CC4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Dromara UJCMS 101.2. Este problema afecta a la funci\u00f3n deleteDirectory del archivo WebFileTemplateController.delete del componente Gestor de Plantillas. Dicha manipulaci\u00f3n conduce a un salto de ruta. El ataque puede realizarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2953", "lastModified": "2026-06-17T10:32:06.250", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2953", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T16:02:56.136047Z", "version": "2.0.3"}}]}, "published": "2026-02-22T14:16:02.890", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347319"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347319"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.755215"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.yuque.com/la12138/pa2fpb/lxngf3d07uyd0nwp?singleDoc"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "101.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "UJCMS", "source": "cna", "vendor": "Dromara"}, "product": "ujcms", "vendor": "dromara"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ujcms", "vendor": "ujcms"}], "analysis": {"en": {"generated_at": "2026-04-18T17:47:55.985459+00:00", "value": {"mitigation_remediation": ["Apply the vendor-provided patch or upgrade to a fixed version as soon as it becomes available.", "Restrict access to the WebFileTemplateController delete endpoint by enabling authentication and authorizing only privileged roles.", "Implement input validation to ensure that the file path remains within the intended directory and reject any attempts that contain traversal characters such as \"../\".", "If a patch is not yet available, consider temporarily disabling the deleteDirectory functionality or blocking access to the endpoint until remediation can be applied."], "summary": {"action": "Patch", "impact": "Path Traversal leading to remote deletion of arbitrary files"}, "threat_synthesis": {"affected_systems": "The flaw affects Dromara UJCMS version 101.2 and earlier releases. System administrators should verify the exact build installed and check for updates provided by the vendor.", "description_and_impact": "This vulnerability arises in the deleteDirectory function of the WebFileTemplateController, allowing an attacker to manipulate file paths and delete files outside the intended directory scope. The description indicates that the attack may be performed from remote, suggesting that remote attackers can specify arbitrary file paths through the delete endpoint, potentially removing critical configuration files or user data. Such an action compromises data integrity and availability, especially if the affected files belong to the CMS core or site content.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity for the path traversal flaw. The EPSS score of less than 1% signals a currently low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be performed remotely by sending a crafted request to the delete endpoint of the WebFileTemplateController. This inference assumes an HTTP interface, which is suggested by the web controller naming convention. The CVE description does not provide specifics about authentication or authorization checks, so it is unclear whether an attacker would require prior access to the CMS. Nonetheless, successful exploitation would allow deletion of arbitrary files within the server filesystem, potentially compromising data integrity and availability."}}}}, "created": "2026-02-23T14:28:54.668692+00:00", "updated": "2026-04-18T18:00:06.451094+00:00", "vendors": ["dromara", "dromara$PRODUCT$ujcms", "ujcms", "ujcms$PRODUCT$ujcms"]}