MEDIUM SeverityCVSS 4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVE-2026-7673

Last updated May 03, 2026 · Published May 03, 2026

Description

A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

1 listed

crmeb_java

Mappings

CWE

CWE-284CWE-434

CAPEC

None listed.

Research

File upload security: validation, isolation, and scanningInsecure file uploads are still one of the fastest paths to RCE. Validate type and size, store outside the web…

Guides

Secure File Uploads in Node.jsValidation, scanning, storage isolation, and safe serving patterns.

Training

CVE-2026-7673

Description

Affected products

Mappings

Related