PT-2026-21944 · Feiyuchuixue · Sz-Boot-Parent

Yuccun · Published 2026-02-25 · Updated 2026-02-28 · CVE-2026-3189

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta

Description A weakness exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta. This issue affects unknown code within the /api/admin/common/files/download file. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be executed remotely and is considered highly complex with difficult exploitability. The developers addressed this by adding a URL protocol whitelist validation to the file download interface, allowing only 'http' and 'https' protocols.

Recommendations Upgrade to version 1.3.3-beta to resolve this vulnerability.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3189

Affected Products

Sz-Boot-Parent

References · 11

• 🔥 https://github.com/yuccun/CVE/blob/main/sz-boot-parent-SSRF_and_Arbitrary_File_Read.md · Exploit
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802 · Patch
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3189 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3189 · Vendor Advisory
• https://github.com/feiyuchuixue/sz-boot-parent · Note
• https://twitter.com/CVEnew/status/2027744274033324310 · Twitter Post
• https://vuldb.com/?ctiid.347747 · Note
• https://t.me/CVEtracker/45736 · Telegram Post
• https://vuldb.com/?id.347747 · Note
• https://vuldb.com/?submit.754042 · Note