A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
References
| Link | Resource |
|---|---|
| https://github.com/jishenghua/jshERP/ | Product |
| https://github.com/jishenghua/jshERP/issues/146 | Exploit Issue Tracking |
| https://github.com/jishenghua/jshERP/issues/146#issue-3817997461 | Exploit Issue Tracking |
| https://vuldb.com/?ctiid.343245 | Permissions Required VDB Entry |
| https://vuldb.com/?id.343245 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.739805 | Third Party Advisory VDB Entry |
| https://github.com/jishenghua/jshERP/issues/146 | Exploit Issue Tracking |
| https://github.com/jishenghua/jshERP/issues/146#issue-3817997461 | Exploit Issue Tracking |
Configurations
History
09 Feb 2026, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jishenghua/jshERP/ - Product | |
| References | () https://github.com/jishenghua/jshERP/issues/146 - Exploit, Issue Tracking | |
| References | () https://github.com/jishenghua/jshERP/issues/146#issue-3817997461 - Exploit, Issue Tracking | |
| References | () https://vuldb.com/?ctiid.343245 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.343245 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.739805 - Third Party Advisory, VDB Entry | |
| First Time |
Jishenghua
Jishenghua jsherp |
|
| CPE | cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* |
29 Jan 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jishenghua/jshERP/issues/146 - | |
| References | () https://github.com/jishenghua/jshERP/issues/146#issue-3817997461 - |
28 Jan 2026, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-28 23:15
Updated : 2026-02-09 16:21
NVD link : CVE-2026-1549
Mitre link : CVE-2026-1549
CVE.ORG link : CVE-2026-1549
JSON object : View
Products Affected
jishenghua
- jsherp
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')