CVE-2026-2665

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2665
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2665.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2665
Published
2026-02-18T20:02:07Z
Modified
2026-10-08T02:50:43Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload
Details

A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-284",
        "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2665.json"
}
References

Affected packages

Git / github.com/huanzi-qch/base-admin

Affected ranges

Type
GIT
Repo
https://github.com/huanzi-qch/base-admin
Events
Introduced
57a8126bb3353a004f3c7722089e3b926ea83596
Last Affected
57a8126bb3353a004f3c7722089e3b926ea83596

Affected versions

Other
57a8126bb3353a004f3c7722089e3b926ea83596

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2665.json"