CVE-2026-11467: medium-severity vulnerability in jishenghua jshERP
jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
jishenghua · jshERPpublic PoCs found — 1
cve_referencegithub.com/jishenghua/jshERP/issues/154unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — jishenghua jshERP
In the same product, most dangerous first.
CVE-2026-1588MEDIUMjishenghua jshERP installByPath install path traversalEPSS 0.7%CVE-2026-94501HIGHjshERP through 3.6 Privilege Escalation via userBusiness CRUDEPSS 0.5%CVE-2026-94413HIGHjshERP through 3.6 Password Hash Disclosure via /user/infoEPSS 0.5%CVE-2026-94412HIGHjshERP through 3.6 Authorization Bypass via resetPwdEPSS 0.5%CVE-2026-94411HIGHjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypeEPSS 0.5%CVE-2026-1549MEDIUMjishenghua jshERP PluginController uploadPluginConfigFile path traversalEPSS 0.5%