CVE-2026-1588
Path Traversal in jshERP DefaultPluginOperator Enables Remote Exploit
Publication date: 2026-01-29
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jishenghua | jsherp | to 3.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1588 is a path traversal vulnerability in jishenghua jshERP versions up to 3.6. It occurs in the install function of the file /jshERP-boot/plugin/installByPath within the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The vulnerability arises because the user-supplied path argument is not properly validated or sanitized, allowing an attacker to manipulate the path to traverse directories outside the intended restricted directory. This enables unauthorized access to files on the server. The attack can be launched remotely via HTTP POST requests but requires some level of authentication. A proof-of-concept exploit is publicly available, demonstrating how an attacker can disclose sensitive file system information by using directory traversal sequences like ".." in the path parameter. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to information disclosure by allowing an attacker to access and determine the existence and type of arbitrary files on the affected server. By exploiting the path traversal flaw, an attacker can gain unauthorized access to sensitive files outside the intended directory, potentially exposing confidential information. Although the vulnerability does not allow modification or deletion of files, the leakage of sensitive data can compromise confidentiality and may facilitate further attacks. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests to the endpoint `/jshERP-boot/plugin/installByPath` with a `path` parameter containing directory traversal sequences such as `..`. For example, you can use network monitoring tools or web server logs to identify suspicious requests like: POST /jshERP-boot/plugin/installByPath?path=../../../../../../etc/passwd Additionally, you can attempt to test the vulnerability by sending crafted POST requests to the endpoint with path traversal payloads to check if the server responds with information about files outside the intended directory. A sample curl command to test this could be: curl -X POST "http://<target>/jshERP-boot/plugin/installByPath?path=../../../../../../opt/test.txt" If the response indicates the existence or type of the file, the system is vulnerable. Monitoring for such requests or responses can help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Restrict access to the vulnerable endpoint `/jshERP-boot/plugin/installByPath` by implementing network-level controls such as firewall rules or IP whitelisting to limit who can send requests. 2. Monitor and block HTTP requests containing directory traversal sequences like `..` in the `path` parameter. 3. Since no official patch or fix has been provided by the project, consider replacing jshERP with an alternative product that does not have this vulnerability. 4. If possible, disable or restrict the plugin installation feature until a fix is available. 5. Review logs for any suspicious activity related to this vulnerability and respond accordingly. These steps help reduce the risk of exploitation until an official patch or update is released. [1]