CVE-2026-37430: Arbitrary File Access in qihang-wms

Successful exploitation of this Arbitrary File Access vulnerability in qihang-wms could allow attackers to execute arbitrary code on the server. This could lead to complete system compromise, data theft, and denial of service. Attackers could upload malicious scripts or executables that would be executed with the privileges of the qihang-wms application. The impact is particularly severe if the server is exposed to the internet or if the application has access to sensitive data. This type of vulnerability is often exploited to gain persistent access to a system.

1. Reserviert2026-04-06
2. Veröffentlicht2026-05-13

Due to the unknown affected versions, immediate code review of the ShopOrderImportController.java component in commit 75c15a is critical. Implement strict file upload validation, including whitelisting allowed file types and sizes. Sanitize file names to prevent path traversal attacks. Store uploaded files in a secure location with restricted access. Consider using a sandboxing environment to execute uploaded files. Regularly scan the application for vulnerabilities using static and dynamic analysis tools. After code remediation, thoroughly test the application to confirm the vulnerability is resolved.