CVE-2026-19761

DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal

State: Published
Severity: 5.1 Medium
Published: Aug 13, 2026
Updated: Aug 14, 2026
Reserved: Aug 13, 2026

Description

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	4.7 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	5.8 Medium	AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
TaierDTStack	1.4.0Affected 1.5.0Not affected

References

VDB-389664 | DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversalvdb-entrytechnical-description
VDB-389664 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-19761 | CVE Analysis and Reportthird-party-advisory
Submit #868965 | DTStack taier v1.4.0 Path Traversalthird-party-advisory
https://github.com/DTStack/Taier/issues/1202issue-tracking
https://github.com/DTStack/Taier/commit/572773c4315e23e51e30115151cb091749a8d03epatch
https://github.com/DTStack/Taier/releases/tag/v1.5.0patch
https://github.com/DTStack/Taier/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.