CVE-2026-2557
cskefu File Upload MediaController.java upload cross site scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 16, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 15, 2026
Description
A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the component File Upload. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
cskefun/a |
|
References
- VDB-346165 | cskefu File Upload MediaController.java upload cross site scriptingvdb-entrytechnical-description
- VDB-346165 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #750729 | cskefu v8 Improper Input Validationthird-party-advisory
- https://fx4tqqfvdw4.feishu.cn/docx/ZqvtdTniToQMw0xZL94cTpuTnacexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.