CVE-2026-3719
Path Traversal in Tsinghua Unigroup Archives System Allows Remote Exploit
Publication date: 2026-03-08
Last updated on: 2026-03-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tsinghua_unigroup | electronic_archives_system | 3.2.210802 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability impact me? :
Exploiting this vulnerability allows attackers to read sensitive files on the affected system, potentially exposing confidential information such as configuration files and credentials.
Since the attack can be initiated remotely without authentication, it poses a significant risk to the confidentiality of the system.
There are no known mitigations or countermeasures provided by the vendor, increasing the risk of exploitation.
Can you explain this vulnerability to me?
CVE-2026-3719 is a remote path traversal vulnerability found in Tsinghua Unigroup Electronic Archives System version 3.2.210802 (build 62532).
The vulnerability exists in the /System/Cms/downLoad interface, where the path parameter can be manipulated by unauthenticated attackers to access arbitrary files on the underlying server.
This improper handling of the path argument allows attackers to bypass directory restrictions and read files outside the intended directory.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring requests to the /System/Cms/downLoad interface for suspicious manipulation of the "path" parameter that attempts path traversal sequences such as "../" to access unauthorized files.'}, {'type': 'paragraph', 'content': 'Network detection can involve inspecting HTTP requests for unusual or malformed path parameters targeting the vulnerable endpoint.'}, {'type': 'paragraph', 'content': 'Since a proof-of-concept exploit is publicly available, security teams can use it in a controlled environment to verify if their system is vulnerable.'}, {'type': 'paragraph', 'content': 'Suggested commands for detection might include using tools like curl or wget to test the endpoint manually, for example:'}, {'type': 'list_item', 'content': 'curl -v "http://[target]/System/Cms/downLoad?path=../../../../etc/passwd"'}, {'type': 'list_item', 'content': 'tcpdump or Wireshark filters to capture HTTP traffic containing "/System/Cms/downLoad" and suspicious path parameters.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the /System/Cms/downLoad endpoint to trusted users or internal networks only.'}, {'type': 'paragraph', 'content': 'Implement input validation and sanitization on the "path" parameter to prevent path traversal sequences.'}, {'type': 'paragraph', 'content': 'If possible, apply any available patches or updates from the vendor; however, in this case, the vendor did not respond to the disclosure.'}, {'type': 'paragraph', 'content': 'Consider replacing the affected product with an alternative solution that does not have this vulnerability.'}, {'type': 'paragraph', 'content': 'Monitor logs for exploitation attempts and block suspicious IP addresses.'}] [3]