CVE-2026-96678

Received Received - Intake

Path Traversal in Spring Boot Forum Avatar Upload

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-96678

Affected Vendors & Products

Vendor	Product	Version / Range
weiqingwen	spring-boot-forum	to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the weiqingwen spring-boot-forum software. It exists in the validate function of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java, specifically in the Avatar Upload component. The vulnerability allows manipulation of the Username argument, which can lead to unauthorized access to files outside the intended directory.

Detection Guidance

This vulnerability involves path traversal in the Avatar Upload component of weiqingwen spring-boot-forum due to improper validation of the Username argument. To detect it, inspect the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java for the validate function and check if it properly sanitizes user input to prevent path traversal attacks. No specific commands are provided in the context.

Impact Analysis

This vulnerability can be exploited remotely to access sensitive files on the server. An attacker could manipulate the Username parameter to traverse directories and read or modify files they should not have access to. This may lead to data breaches, unauthorized information disclosure, or further attacks on the system.

Compliance Impact

This vulnerability involves a path traversal attack due to improper validation of the Username argument in the Avatar Upload component. Such attacks could allow unauthorized access to sensitive files or directories, potentially exposing personal or health-related data. This may impact compliance with GDPR if personal data is exposed, and HIPAA if protected health information is compromised. However, specific compliance impacts depend on the data processed by the affected system.

Mitigation Strategies

Immediately disable or restrict access to the Avatar Upload component in weiqingwen spring-boot-forum. Review and update input validation for the Username argument in NewUserFormValidator.java to prevent path traversal. Monitor network traffic for unusual file access patterns.

Hi! I’m here to help you understand CVE-2026-96678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70