CVE-2026-18903
yeqifu warehouse FileController.java path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 5, 2026
- Updated
- Aug 5, 2026
- Reserved
- Aug 4, 2026
Description
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
warehouseyeqifu |
|
References
- VDB-385940 | yeqifu warehouse FileController.java path traversalvdb-entrytechnical-description
- VDB-385940 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-18903 | CVE Analysis and Reportthird-party-advisory
- Submit #859531 | GitHub warehouse V1.0 Absolute Path Traversalthird-party-advisory
- https://fanatical-brain-9ba.notion.site/warehouse-381f1a573df48073ae69fd68e2c27b69exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.