Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-1588 A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component co… https://www.cve.org/CVERecord?id=CVE-2026-1588
Post summary
The message reports CVE-2026-1588, identifies the affected component and function, but offers no evidence of exploitation, PoC, or patch, making it a straightforward disclosure.
CVE-2026-1588 Path Traversal Vulnerability in jshERP 3.6 via Plugin Installation Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1588
Post summary
A path traversal vulnerability (CVE-2026-1588) has been disclosed for jshERP 3.6 affecting the plugin installation endpoint.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jishenghua | jsherp | - | - | - |