PT-2026-39423 · Codelib · Fess

R1Ckyz · Published 2026-05-09 · Updated 2026-05-10 · CVE-2026-8211

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions codelibs Fess versions prior to 15.5.2

Description Remote code injection is possible via the JSP File Handler component. The update() function within the file org/codelibs/fess/app/web/admin/design/AdminDesignAction.java fails to properly handle the content argument, allowing a remote attacker to inject malicious code.

Recommendations Update to a version newer than 15.5.1. As a temporary workaround, restrict access to the update() function in the AdminDesignAction.java file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2026-8211

Affected Products

Fess

References · 10

• 🔥 https://bv3acdnplbr.feishu.cn/docx/Kk1tdEAfAoV6kZxVozUc8UA4nog?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8211 · Security Note
• https://vuldb.com/submit/804293 · Note
• https://twitter.com/CVEnew/status/2053537509355999519 · Twitter Post
• https://vuldb.com/vuln/362419/cti · Note
• https://twitter.com/VulmonFeeds/status/2053270190826123696 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053539722593485092 · Twitter Post
• https://t.me/cveNotify/162893 · Telegram Post
• https://t.me/CVEtracker/53254 · Telegram Post
• https://vuldb.com/vuln/362419 · Note