PT-2026-21912 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-3187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions up to 1.3.2-beta

Description A flaw exists in feiyuchuixue sz-boot-parent that allows for unrestricted file uploads. This issue is related to the functionality of the /api/admin/sys-file/upload API endpoint. The attack can be initiated remotely and an exploit is publicly available. The project developers addressed the issue by implementing a whitelist restriction on the /api/admin/sys-file/upload endpoint using the oss.allowedExts and oss.allowedMimeTypes configuration options, which allow specifying permitted file extensions and MIME types for uploads.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2026-3187

Affected Products

Sz-Boot-Parent

References · 10

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Arbitrary_File_Upload.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Patch
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3187 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3187 · Vendor Advisory
• https://github.com/feiyuchuixue/sz-boot-parent · Note
• https://twitter.com/CVEnew/status/2026676416243527752 · Twitter Post
• https://vuldb.com/?ctiid.347745 · Note
• https://vuldb.com/?id.347745 · Note
• https://vuldb.com/?submit.754038 · Note