CVE-2026-78140
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
Risk Assessment
A remote attacker can exploit the vulnerability to inject malicious code into templates, potentially leading to arbitrary code execution on the server or content integrity compromise.
Recommendation
It is recommended to update UJCMS to the latest patched version. Also restrict access to the web-file-template endpoint and follow secure templating practices.
Other vulnerabilities in UJCMS
See all- CVE-2023-34865Critical
CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.
- CVE-2023-34747Critical
There is a file upload vulnerability in ujcms version 6.0.2 via the endpoint /api/backend/core/web-file-upload/upload.
- CVE-2023-34878High
An issue was discovered in Ujcms v6.0.2 that allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
Original NVD description (English source)
A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.