VYPR
← All advisories
Low severity2.7NVD Advisory· Published Jan 29, 2026· Updated Apr 29, 2026

CVE-2026-1588

CVE-2026-1588

Description

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • jshERP/jshERP2 versions
    cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*range: <=3.6
    • (no CPE)range: <=3.6

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.