CVE Catalog
CVE-2026-75339
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk0.15%
4th percentile - higher than 4% of all known CVEs
Summary
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 lacks permission checks. Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.
Risk Assessment
Missing access controls allow unauthorized file upload and download, potentially leading to malware placement or leakage of sensitive data.
Recommendation
Add proper authorization mechanisms for the /storage/upload endpoint and restrict file download access to authorized users only.
Original NVD description (English source)
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.