Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-1549 Path Traversal in jshERP Plugin Upload Functionality via Configfile Argument https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1549
Post summary
The text announces a path traversal flaw in the jshERP plugin’s upload functionality through a configfile argument, without providing PoC, exploitation evidence, patch details, or a false‑positive claim.
CVE-2026-1549 A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginCo… https://www.cve.org/CVERecord?id=CVE-2026-1549
Post summary
The post announces CVE‑2026‑1549 affecting jshERP up to version 3.6, mentioning an issue with the file /jshERP‑boot/plugin/uploadPluginCo… and linking to the CVE record, but offers no further technical, exploit, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jishenghua | jsherp | - | - | - |