PT-2026-21912 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-3187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions up to 1.3.2-beta

Description A flaw exists in feiyuchuixue sz-boot-parent that allows for unrestricted file uploads. This issue is related to the functionality of the /api/admin/sys-file/upload API endpoint. The attack can be initiated remotely and an exploit is publicly available. The project developers addressed the issue by implementing a whitelist restriction on the /api/admin/sys-file/upload endpoint using the oss.allowedExts and oss.allowedMimeTypes configuration options, which allow specifying permitted file extensions and MIME types for uploads.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Correção

Improper Access Control

Unrestricted File Upload

Enumeração de Fraquezas

CWE-284

CWE-434

Identificadores relacionados

CVE-2026-3187

Produtos afetados

Sz-Boot-Parent

Referências · 10

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Arbitrary_File_Upload.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Correção
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Correção
• https://github.com/feiyuchuixue/sz-boot-parent · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3187 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026676416243527752 · Publicação no Twitter
• https://vuldb.com/?ctiid.347745 · Nota
• https://vuldb.com/?id.347745 · Nota
• https://osv.dev/vulnerability/CVE-2026-3187 · Aviso do Fabricante
• https://vuldb.com/?submit.754038 · Nota