jishenghua jshERP installByPath install Pfadüberschreitung

The primary impact of CVE-2026-1588 is unauthorized access to files and directories on the server hosting jshERP. An attacker could leverage this vulnerability to read sensitive configuration files, source code, or other data that could be used to further compromise the system. While the CVSS score is LOW (2.7), the public availability of a proof-of-concept significantly increases the risk of exploitation. Successful exploitation could lead to data breaches, system disruption, and potential lateral movement within the network if the compromised files contain credentials or other sensitive information.

Organizations utilizing jshERP for their ERP needs, particularly those running versions 3.0 through 3.6, are at risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a compromise of one user's jshERP installation could potentially expose data for other users on the same server.

• linux / server: Monitor access logs for requests containing directory traversal sequences (e.g., ../). Use journalctl to filter for errors related to file access attempts.

journalctl -u jshERP -g 'path traversal'

• generic web: Use curl to test for path traversal vulnerabilities by appending directory traversal sequences to the vulnerable endpoint.

curl 'http://<jshERP_server>/jshERP-boot/plugin/installByPath?path=../../../../etc/passwd' 

1. 2026-01-29Disclosure

   disclosure

1. Reserviert2026-01-29
2. Veröffentlicht2026-01-29
3. Geändert2026-02-23
4. EPSS aktualisiert2026-03-23

Due to the lack of a provided fix, immediate mitigation strategies are crucial. Implement strict access controls to limit the potential damage from unauthorized file access. Consider using a Web Application Firewall (WAF) to filter requests and block attempts to exploit the path traversal vulnerability. Monitor system logs for suspicious activity, particularly requests containing directory traversal sequences (e.g., ../). While a direct patch is unavailable, regularly review and harden the jshERP configuration to minimize the attack surface. Verification after implementing these measures should involve attempting to access restricted files via the vulnerable endpoint and confirming access is denied.