CVE-2026-11467: fallo de gravedad media en jishenghua jshERP
jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.3%
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
jishenghua · jshERPPoCs públicas encontradas — 1
cve_referencegithub.com/jishenghua/jshERP/issues/154no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — jishenghua jshERP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-1588MEDIUMjishenghua jshERP installByPath install path traversalEPSS 0.7%CVE-2026-94501HIGHjshERP through 3.6 Privilege Escalation via userBusiness CRUDEPSS 0.5%CVE-2026-94413HIGHjshERP through 3.6 Password Hash Disclosure via /user/infoEPSS 0.5%CVE-2026-94412HIGHjshERP through 3.6 Authorization Bypass via resetPwdEPSS 0.5%CVE-2026-94411HIGHjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypeEPSS 0.5%CVE-2026-1549MEDIUMjishenghua jshERP PluginController uploadPluginConfigFile path traversalEPSS 0.5%