CVE-2026-11467
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In jishenghua jshERP up to version 3.6, the addAccountHeadAndDetail function in AccountHeadService.java is vulnerable to path traversal via the fileName argument, allowing a remote attacker to manipulate file paths.
Risk Assessment
A remote attacker can read arbitrary files on the server, including sensitive data, potentially leading to information disclosure.
Recommendation
The project has not responded; it is recommended to temporarily disable the addAccountHeadAndDetail endpoint or apply custom security measures.
Other vulnerabilities in jshERP
See all- CVE-2026-11469Medium
jishenghua jshERP up to version 3.6 is vulnerable to Server-Side Request Forgery (SSRF) in the insertPlatformConfig function. Manipulating the platformValue argument allows remote attackers to make server-side requests.
- CVE-2025-55371Medium
In jshERP v3.5, the component PersonController.java has incorrect access control, allowing unauthorized attackers to obtain all handler information by executing the getAllList method.
- CVE-2025-55370High
In jshERP v3.5, the ResourceController.java component has an incorrect access control vulnerability. An unauthorized attacker can obtain all corresponding ID data by modifying the ID value.
- CVE-2025-55368High
In jshERP v3.5, the RoleController.java component has incorrect access control, allowing unauthorized attackers to arbitrarily modify the supplier status under any account.
- CVE-2025-55367Medium
In jshERP v3.5, the SupplierController.java component has an incorrect access control vulnerability, allowing unauthorized attackers to arbitrarily modify supplier status on any account.
- CVE-2025-55366Medium
In jshERP v3.5, incorrect access control in the UserController.java component allows attackers to arbitrarily reset user account passwords. This vulnerability enables a horizontal privilege escalation attack.
Original NVD description (English source)
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.