A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.341629 | Permissions Required VDB Entry |
| https://vuldb.com/?id.341629 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.731240 | Third Party Advisory VDB Entry |
Configurations
History
08 Mar 2026, 01:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xiweicheng:teamwork_management_system:*:*:*:*:*:*:*:* | |
| First Time |
Xiweicheng teamwork Management System
Xiweicheng |
|
| References | () https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.341629 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.341629 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.731240 - Third Party Advisory, VDB Entry |
17 Jan 2026, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-17 19:15
Updated : 2026-03-08 01:34
NVD link : CVE-2026-1061
Mitre link : CVE-2026-1061
CVE.ORG link : CVE-2026-1061
JSON object : View
Products Affected
xiweicheng
- teamwork_management_system