CVE-2026-2665

huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload

State: Published
Severity: 5.3 Medium
Published: Feb 18, 2026
Updated: Feb 23, 2026
Reserved: Feb 18, 2026

Description

A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
base-adminhuanzi-qch	57a8126bb3353a004f3c7722089e3b926ea83596Affected

References

VDB-346462 | huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted uploadvdb-entrytechnical-description
VDB-346462 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #753240 | https://github.com/huanzi-qch/base-admin base-admin v1.0 Upload any filethird-party-advisory
https://github.com/huanzi-qch/base-admin/issues/38issue-tracking
https://github.com/huanzi-qch/base-admin/issues/38#issue-3905100373exploitissue-tracking
https://github.com/huanzi-qch/base-admin/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.