CVE-2026-30403

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30403", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-24T01:14:09.838Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-19T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-19T16:02:33.447Z"}, "descriptions": [{"lang": "en", "value": "There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/tianshiyeben/wgcloud/issues/97"}, {"url": "https://github.com/TTTlw1024/qwe/issues/2"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T01:12:06.627033Z", "id": "CVE-2026-30403", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T01:14:09.838Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30403", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T01:12:06.627033Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T01:12:29.111Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/tianshiyeben/wgcloud/issues/97"}, {"url": "https://github.com/TTTlw1024/qwe/issues/2"}], "descriptions": [{"lang": "en", "value": "There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-19T16:02:33.447Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30403", "state": "PUBLISHED", "dateUpdated": "2026-03-24T01:14:09.838Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-19T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wgstart:wgcloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE012BD6-0C9B-4F63-957E-78C9565F977C", "versionEndIncluding": "3.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server."}, {"lang": "es", "value": "Hay una vulnerabilidad de lectura arbitraria de archivos en la funci\u00f3n de prueba de conexi\u00f3n de la gesti\u00f3n de bases de datos de backend en wgcloud v3.6.3 y versiones anteriores, que puede ser utilizada para leer cualquier archivo en el servidor de la v\u00edctima."}], "id": "CVE-2026-30403", "lastModified": "2026-06-17T10:32:40.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30403", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T01:12:06.627033Z", "version": "2.0.3"}}]}, "published": "2026-03-19T17:16:23.950", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/TTTlw1024/qwe/issues/2"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://github.com/tianshiyeben/wgcloud/issues/97"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.3]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "wgcloud", "vendor": "tianshiyeben"}], "analysis": {"en": {"generated_at": "2026-04-02T13:27:16.105523+00:00", "value": {"mitigation_remediation": ["Upgrade wgcloud to version 3.6.4 or later (or apply the vendor\u2019s patch for version 3.6.3 and earlier).", "If an immediate upgrade is not possible, restrict network access to the wgcloud backend service to trusted IP addresses only.", "Monitor system logs for repeated test connection requests and investigate any suspicious activity."], "summary": {"action": "Patch ASAP", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The affected product is wgcloud developed by wgstart. Versions 3.6.3 and all earlier releases of wgcloud are impacted.", "description_and_impact": "The vulnerability resides in the test connection function of the backend database management in wgcloud, allowing an attacker to read any file on the victim\u2019s server when using wgcloud version 3.6.3 or earlier. This can expose configuration files, credentials, and other sensitive data, enabling broader compromise or data exfiltration.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity potential impact. EPSS indicates that exploitation is unlikely (<1%), and the vulnerability is not listed in CISA\u2019s KEV catalog. Based on the nature of the function, the attack vector is inferred to be remote via the web interface or API that exposes the test connection endpoint."}}}}, "created": "2026-03-20T08:58:07.942785+00:00", "updated": "2026-04-02T20:23:24.124265+00:00", "vendors": ["tianshiyeben", "tianshiyeben$PRODUCT$wgcloud"]}