CVE-2023-34747
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
There is a file upload vulnerability in ujcms version 6.0.2 via the endpoint /api/backend/core/web-file-upload/upload.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious files, potentially leading to system compromise.
Recommendation
It is recommended to update to the latest version of ujcms and implement appropriate security measures for uploaded files.
Other vulnerabilities in ujcms 6.0.2
See all- CVE-2023-34865Critical
CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.
- CVE-2026-78140Medium
A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
- CVE-2023-34878High
An issue was discovered in Ujcms v6.0.2 that allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
Original NVD description (English source)
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.