CVE-2026-1061
BaseFortify
Publication date: 2026-01-17
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xiweicheng | teamwork_management_system | to 2.28.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1061 is an arbitrary file upload vulnerability in xiweicheng TMS up to version 2.28.0. It occurs in the Upload function of the FileController.java file, where the filename argument is not properly validated or filtered. This allows attackers to upload files without restriction, including potentially dangerous files, which can be processed by the system. The vulnerability can be exploited remotely without authentication, making it easy for attackers to exploit. [1, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to upload malicious files to your system, potentially leading to unauthorized access, data compromise, or disruption of service. It affects the confidentiality, integrity, and availability of the system. Since the exploit is public and can be performed remotely without authentication, it poses a significant security risk. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for arbitrary file uploads to the affected FileController.java upload function. Since the vulnerability allows unrestricted file uploads via the filename argument, you can detect exploitation attempts by inspecting web server logs for unusual POST requests to the upload endpoint, especially those containing suspicious filenames or file types. Network intrusion detection systems (NIDS) can be configured to alert on HTTP POST requests with file upload patterns targeting the vulnerable endpoint. Specific commands depend on your environment, but examples include using grep on web server logs: `grep 'POST /upload' /var/log/apache2/access.log` or using tools like Wireshark or Zeek to monitor HTTP traffic for suspicious uploads. However, no explicit detection commands are provided in the resources. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected xiweicheng TMS software version (up to 2.28.0) with an alternative product, as no known countermeasures or mitigations are currently available. Restricting or disabling the file upload functionality temporarily can reduce risk. Additionally, implementing strict input validation and filtering on uploaded files, if possible, may help mitigate exploitation. Monitoring for exploit attempts and applying network-level protections such as web application firewalls (WAF) to block suspicious upload requests are recommended until a secure version or patch is available. [3]