PT-2026-21944 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Publicado 2026-02-25 · Atualizado 2026-02-28 · CVE-2026-3189

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta

Description A weakness exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta. This issue affects unknown code within the /api/admin/common/files/download file. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be executed remotely and is considered highly complex with difficult exploitability. The developers addressed this by adding a URL protocol whitelist validation to the file download interface, allowing only 'http' and 'https' protocols.

Recommendations Upgrade to version 1.3.3-beta to resolve this vulnerability.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-3189

Produtos afetados

Sz-Boot-Parent

Referências · 11

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-SSRF_and_Arbitrary_File_Read.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Correção
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Correção
• https://github.com/feiyuchuixue/sz-boot-parent · Nota
• https://twitter.com/CVEnew/status/2027744274033324310 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3189 · Nota de Segurança
• https://vuldb.com/?ctiid.347747 · Nota
• https://osv.dev/vulnerability/CVE-2026-3189 · Aviso do Fabricante
• https://t.me/CVEtracker/45736 · Publicação no Telegram
• https://vuldb.com/?id.347747 · Nota
• https://vuldb.com/?submit.754042 · Nota