CVE-2026-19761

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19761
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19761.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19761
Published
2026-08-13T23:45:09.227Z
Modified
2026-08-17T04:19:19.552898Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal
Details

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19761.json"
}
References

Affected packages

Git / github.com/dtstack/taier

Affected ranges

Type
GIT
Repo
https://github.com/dtstack/taier
Events
Introduced
726c3569c38ef4340f095d8f4edbd09ca4736c5e
Fixed
572773c4315e23e51e30115151cb091749a8d03e
Fixed
f4e300d7d7925ca56ccd94433197df2a567e0584
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4.0

Database specific

vanir_signatures_modified 
"2026-08-17T04:19:19Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19761.json"
vanir_signatures 
[
    {
        "id": "CVE-2026-19761-29a44c55",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "252110588856525027209762828285385381119",
            "length": 461.0
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "getConn"
        }
    },
    {
        "id": "CVE-2026-19761-2e2efe85",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "238052077414147473175528123445295522804",
            "length": 827.0
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "transHikari"
        }
    },
    {
        "id": "CVE-2026-19761-504e1369",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "210268226435147891574461985119480790415",
            "length": 657.0
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java",
            "function": "decryptionWithOutExpire"
        }
    },
    {
        "id": "CVE-2026-19761-5814d497",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "36101654723752963671468391188594742566",
                "266975784176588441000147233037759567003",
                "109295735511198719340542069102487805256",
                "49708602931808221299346730980186039280",
                "13991529441215025390192596276672690518",
                "169251688526484849097745895143110156730",
                "44426218015766643007968678064374156432",
                "339981098549619939903025553356782039233",
                "314503536844495180440667613477899778375",
                "118652442983201032339315826420240849797",
                "333177348032164149600207385354093050499",
                "99366457190681760266393816555440903741",
                "109670741050615322959578904653808895553",
                "168855522604373179475141582343737444970",
                "32554661586419647712731400211784141688",
                "88546926172557243678488129370100974282",
                "291068160312955710959603665154263820947",
                "3570220999890180787607281538556093042",
                "238886111497660008127827868965013304630",
                "129218712532806902266950530882281566232",
                "297909659541046377164125986583720913079",
                "190925097834081390279114434609070453827",
                "88946873070396081264159611644183025435"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/dtstack/taier/commit/572773c4315e23e51e30115151cb091749a8d03e",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java"
        }
    },
    {
        "id": "CVE-2026-19761-6bcb4058",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "178031687960366436386792099211285137179",
            "length": 930.0
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java",
            "function": "decryption"
        }
    },
    {
        "id": "CVE-2026-19761-ab4bdecb",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "125207652754199758225664958899669835853",
                "113754164451565641000613584342290843041",
                "141425158978808431014691412966692470833",
                "114363188307720565462939090333811399551",
                "36601068879786074217074935712802022100",
                "133822278915987205917951028871012943291",
                "277953684701032936003686227368651036328",
                "73347492585308774451832137588537897914",
                "211546483702716288425633132004785933916",
                "2638074789996013983460603480420169526",
                "132662104378991811248035567767854969940",
                "93278929754112218543959029082879225429",
                "296845061050133467957579243309393489571",
                "151147890598538299944212756230645561921"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/service/user/TokenService.java"
        }
    },
    {
        "id": "CVE-2026-19761-d620d7f4",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "60796052975008364307783445339376599110",
            "length": 618.0
        },
        "source": "https://github.com/dtstack/taier/commit/572773c4315e23e51e30115151cb091749a8d03e",
        "target": {
            "file": "taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java",
            "function": "getResourcesFromFiles"
        }
    },
    {
        "id": "CVE-2026-19761-e85404c2",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "236775718364273575342317746185271799712",
            "length": 756.0
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java",
            "function": "getSimpleConn"
        }
    },
    {
        "id": "CVE-2026-19761-fc5b0ca8",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "35476722405304426314718055141130854298",
                "16973448835063610288451592523618252216",
                "208529561540805787307660125334485094702",
                "233900185467647299823924075632775021527",
                "106116714497235214317126491040361214858",
                "219148540555351613109520622894201884615",
                "97254051285827677200279067890710869194",
                "44995672955429159814180400178989506082",
                "160528109069049956057754407836615276621",
                "119492301685871779104214419493479752856",
                "227958328209535333101371665483180745996",
                "106927720226904905315778844445831734310",
                "91132970460554597457606242107045376336",
                "302170076216052741506721647604372007224",
                "94493790147554251692033773996287882352",
                "111191101673056953953846148935517044768",
                "14831340577830171425188789115927455234",
                "274737605157407583061928697892153883614",
                "281968164159869358151554821808630275726",
                "3423668703749450574163292758860765687",
                "329485612476973805250658545245075752673",
                "255064482410696838331439574146571247252",
                "15655972123580844902986151931643655478",
                "59751113054416544808108457720687475633",
                "122118838471393365148778894450929673690",
                "73966362460831841439477427686330343594",
                "287622994490669714933675734150734508998",
                "232658759576845558036461462343177467376",
                "158973815840826676194590650781040299185",
                "253051636472804511029889529491915326187",
                "225682506161643824595308298676092342009",
                "266060369478870144866320966974863496529",
                "99280198404030792824085209161719429458",
                "14381875794951400378783882723412142605",
                "200889065496396159670761705443025986305",
                "324166437850423912578549953902630697095",
                "132485060053145569814965282497041696471",
                "183967761888338131550302499658054889141",
                "290438919889072939929634167697564493499",
                "217728902571395355879117313241969045991",
                "121832372608264440280495193953948662472",
                "125238076663653029723941085581757147327"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/dtstack/taier/commit/f4e300d7d7925ca56ccd94433197df2a567e0584",
        "target": {
            "file": "taier-datasource/taier-datasource-plugin/taier-datasource-plugin-rdbms/src/main/java/com/dtstack/taier/datasource/plugin/rdbms/ConnFactory.java"
        }
    }
]