CVE-2026-11467: jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate and sanitize the fileName argument on the server side before use: remove or reject path separators and '..' segments, normalize the path, and enforce an allowlist of permitted filenames or restrict file operations to a designated safe directory.
jishenghua jshERP (addAccountHeadAndDetail endpoint) fileName input validation = sanitize and normalize; disallow path traversal characters/segments - Compensating control
Temporarily restrict access to the addAccountHeadAndDetail endpoint until a code fix is applied: require strong authentication/authorization, apply firewall or WAF rules to block or rate-limit requests to the endpoint, and/or apply an IP allowlist to limit callers.
- Operational
Audit application and server file-access logs for suspicious calls to addAccountHeadAndDetail and any access patterns indicating path traversal (e.g., filenames containing '../' or unexpected absolute paths). Treat the disclosure as potentially exploited and investigate related systems for signs of compromise.
Event History
Frequently Asked Questions
What is CVE-2026-11467?
CVE-2026-11467 is a path traversal vulnerability in the addAccountHeadAndDetail endpoint of jishenghua jshERP, affecting version up to 3.6.
What is the severity of CVE-2026-11467?
The severity of CVE-2026-11467 is classified as medium with a score of 5.4.
How do I fix CVE-2026-11467?
To fix CVE-2026-11467, update to the latest version of jishenghua jshERP that addresses this vulnerability.
What systems are affected by CVE-2026-11467?
CVE-2026-11467 affects jishenghua jshERP versions up to 3.6.
What are the potential impacts of CVE-2026-11467?
The exploitation of CVE-2026-11467 could allow an attacker to manipulate file paths, potentially leading to unauthorized data access.