CVE-2026-24815

Critical

Published: 27/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Unrestricted file upload and untrusted data deserialization in tis before v4.3.0 in XmlFile.Java. May allow uploading malicious files and code execution.

Risk Assessment

Risk of remote code execution or server compromise via malicious file upload.

Recommendation

Update tis to v4.3.0 or later and restrict file uploads to trusted users.

Original NVD description (English source)

Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules). This vulnerability is associated with program files XmlFile.Java. This issue affects tis: before v4.3.0.