PT-2026-36677 · Kerwincui · Fastbee

Xcxr · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7676

NVD

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7676

Affected Products

Fastbee

References · 5

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7676 · Security Note
• https://vuldb.com/vuln/360829 · Note
• https://vuldb.com/submit/800723 · Note
• https://vuldb.com/vuln/360829/cti · Note