CVE-2026-19761: DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal
A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilenameto a version that resolves this vulnerability.Fixed in 1.5.0Patch 572773c4315e23e51e30115151cb091749a8d03e - Compensating control
Because the attack may be initiated remotely and involves path traversal via MultipartFile.getOriginalFilename in UploadController.java, restrict remote access to the Upload Controller endpoints (e.g., via network ACL/firewall/WAF) to reduce exposure while remediation is in progress.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19761?
The severity of CVE-2026-19761 is medium with a score of 4.7.
What type of vulnerability is CVE-2026-19761?
CVE-2026-19761 is a path traversal vulnerability.
How do I fix CVE-2026-19761?
To fix CVE-2026-19761, upgrading to a patched version of DTStack Taier is recommended.
Can CVE-2026-19761 be exploited remotely?
Yes, CVE-2026-19761 can be exploited remotely.
What component is affected by CVE-2026-19761?
The affected component in CVE-2026-19761 is the Upload Controller in UploadController.java.