CVE-2026-18903
Received Received - Intake

Path Traversal in yeqifu Warehouse

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulDB

Description
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18903
EUVD
EUVD-2026-53047

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeqifu warehouse to aaf29962ba407d22d991781de28796ee7b4670e4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the yeqifu warehouse software. It allows remote attackers to manipulate the 'path' argument in the FileController.java file to access unauthorized directories. The exploit is publicly available and the vendor did not respond to the disclosure.

Impact Analysis

An attacker could exploit this to read sensitive files outside the intended directory, potentially exposing confidential data. Since the attack is remote, any system running the vulnerable yeqifu warehouse version is at risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR (data protection) and HIPAA (health information privacy) by allowing access to sensitive personal or medical data. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Immediately restrict access to the FileController.java component. Review and filter user inputs for path traversal patterns like '../'. Disable remote access if not required. Monitor network traffic for suspicious file access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart