PT-2026-21937 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Published 2026-02-25 · Updated 2026-02-28 · CVE-2026-3188

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta

Description A security issue exists in feiyuchuixue sz-boot-parent. The issue affects an unknown part of the file /api/admin/common/download/templates within the API component. Manipulation of the templateName parameter can lead to path traversal. Remote exploitation is possible. The exploit has been publicly released. The project developers have implemented path validity checks on parameters for the template download interface to address this issue.

Recommendations Upgrade to version 1.3.3-beta.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3188

Affected Products

Sz-Boot-Parent

References · 12

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Path_Traversal_to_Arbitrary_Resource_File_Read.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Patch
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Patch
• https://osv.dev/vulnerability/CVE-2026-3188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3188 · Security Note
• https://github.com/feiyuchuixue/sz-boot-parent · Note
• https://twitter.com/CVEnew/status/2027744281125921261 · Twitter Post
• https://vuldb.com/?ctiid.347746 · Note
• https://vuldb.com/?submit.754041 · Note
• https://t.me/CVEtracker/45753 · Telegram Post
• https://vuldb.com/?id.347746 · Note
• https://t.me/cveNotify/153484 · Telegram Post