CVE-2026-75339: Cjbi admin3 vulnerability
Published Aug 27, 2026
·Updated
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.
Affected Software
1 affected component
cjbi admin3=3.0.0
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit the upload and download behavior?
Any authenticated user can upload arbitrary files through /storage/upload. Anonymous attackers can download uploaded files without logging in.
2
Is the affected endpoint exposed by default?
The provided information identifies missing permission checks on the endpoint but does not state whether it is enabled or externally reachable by default.
3
How can administrators determine whether they may be affected?
Check whether the deployment uses cjbi admin3 v3.0.0 and whether /storage/upload is accessible. Review uploaded-file storage and access logs for unexpected uploads or anonymous downloads.