PT-2026-21937 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Publicado 2026-02-25 · Atualizado 2026-02-28 · CVE-2026-3188

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta

Description A security issue exists in feiyuchuixue sz-boot-parent. The issue affects an unknown part of the file /api/admin/common/download/templates within the API component. Manipulation of the templateName parameter can lead to path traversal. Remote exploitation is possible. The exploit has been publicly released. The project developers have implemented path validity checks on parameters for the template download interface to address this issue.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-3188

Produtos afetados

Sz-Boot-Parent

Referências · 12

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Path_Traversal_to_Arbitrary_Resource_File_Read.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Correção
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Correção
• https://github.com/feiyuchuixue/sz-boot-parent · Nota
• https://twitter.com/CVEnew/status/2027744281125921261 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3188 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3188 · Nota de Segurança
• https://vuldb.com/?ctiid.347746 · Nota
• https://vuldb.com/?submit.754041 · Nota
• https://t.me/CVEtracker/45753 · Publicação no Telegram
• https://vuldb.com/?id.347746 · Nota
• https://t.me/cveNotify/153484 · Publicação no Telegram