CVE-2026-86672: ningzichun Student Management System Backup example.7z information disclosure
A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of ningzichun Student Management System that include the Backup Handler and make the example.7z file reachable are exposed. The attack can be initiated remotely and requires no privileges or user interaction.
What is the likely impact of successful exploitation?
Successful exploitation results in information disclosure. The available data does not identify what information is contained in example.7z or whether it includes sensitive deployment data.
Is a fixed release available?
No affected or updated release versions are available because the project uses rolling releases. The issue was reported to the project, but it had not responded at the time of the advisory.
What can be done while a patch is unavailable?
Restrict remote access to the Backup Handler and ensure example.7z is not publicly reachable. Review the archive and any data it may expose, and replace or revoke sensitive material found within it as appropriate.
How can administrators check for exposure?
Check whether the application deployment contains example.7z under the Backup Handler and whether it can be retrieved remotely. Because public exploit information exists, prioritize testing from an unauthenticated remote perspective.