CVE-2026-1549CWE-22

jishenghua jshERP PluginController uploadPluginConfigFile path traversal

Medium · published January 28, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00515 · 43.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-28T23:02Z
EPSS history
Timeline
  • 28 JAN 23:02Z
    jishenghua jshERP PluginController uploadPluginConfigFile path traversal
    cvelistv5