CVE-2026-2957
qinming99 dst-admin File BackupController.java deleteBackup denial of service
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 22, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 22, 2026
Description
A weakness has been identified in qinming99 dst-admin up to 1.5.0. This impacts the function deleteBackup of the file src/main/java/com/tugos/dst/admin/controller/BackupController.java of the component File Handler. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.5 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-404 Denial of Service
Affected Products
| Product | Versions |
|---|---|
dst-adminqinming99 |
|
References
- VDB-347324 | qinming99 dst-admin File BackupController.java deleteBackup denial of servicevdb-entrytechnical-description
- VDB-347324 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #754510 | dst-admin dst-admin <= 1.5.0 Improper Input Validationthird-party-advisory
- https://fx4tqqfvdw4.feishu.cn/docx/YKwydLrdno51JtxJksmcWSfbnvd?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.