CVE-2026-11470 json
hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal
published 2026-06-08 5 mo ago modified 2026-07-28 3 mo ago also GHSA-vjmr-f5fc-vr2w , EUVD-2026-35001
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in hs-web hsweb-framework up to 5.0.1. The affected element is the function denied of the file hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java of the component File Upload. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8009845b577d8a2c4bbf4fdd8e8913799a714be6. It is suggested to install a patch to address this issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/hs-web/hsweb-framework/issues/344 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.hswebframework.web:hsweb-system-file | <=5.0.1 |
no fix listed |
Affected products
- hs-web hsweb-framework
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/hs-web/hsweb-framework/commit/8009845b577d8a2c4bbf4fdd8e8913799a714be6
patch, web
-
github.com
/hs-web/hsweb-framework/issues/344
exploit, issue-tracking, web
-
vuldb.com
/vuln/369090
vdb-entry, technical-description, web
-
vuldb.com
/vuln/369090/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-11470
third-party-advisory, web
-
vuldb.com
/submit/833856
third-party-advisory, web
-
github.com
/hs-web/hsweb-framework/issues/344#issuecomment-3798035002
issue-tracking, web
-
github.com
/hs-web/hsweb-framework/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-11470
advisory
-
github.com
/hs-web/hsweb-framework
package
Sources
- CVE List CVE-2026-11470
- GitHub Advisory GHSA-vjmr-f5fc-vr2w
- NVD CVE-2026-11470
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.