CVE-2026-11467

Executive Summary

CVE-2026-11467 is a path traversal vulnerability in jishenghua jshERP, an open-source Enterprise Resource Planning (ERP) system. The flaw resides in the addAccountHeadAndDetail endpoint, specifically within the AccountHeadService.java file. By manipulating the fileName argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading or writing arbitrary files on the server. The vulnerability has a CVSS score of 5.4 (Medium) and a public proof-of-concept (PoC) exploit is available. The vendor has been notified but has not yet released a patch.

Supply Chain & Package Security

This vulnerability affects the jshERP Java application, which is distributed as a Maven-based project. The risk is amplified if the application is deployed in a containerized environment (e.g., Docker) where the base image may contain outdated libraries. Organizations should audit their deployment for any use of jshERP versions 3.6 or earlier and ensure that the application is not exposed to untrusted networks without additional security controls.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The low complexity and lack of authentication requirements make this vulnerability attractive to attackers. While the direct impact is limited to reading and writing files, it could be chained with other vulnerabilities (e.g., remote code execution via uploaded malicious files) to achieve a more severe compromise.

Deep Dive & Mechanics

The vulnerability is located in the addAccountHeadAndDetail function within jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java. This endpoint is designed to handle file uploads associated with account head records. The fileName parameter is used to construct the file path on the server without proper sanitization or validation.

Root Cause: The application fails to validate or sanitize the fileName parameter, allowing an attacker to include path traversal sequences (e.g., ../) to escape the intended upload directory. This enables the attacker to read arbitrary files (e.g., configuration files, application source code) or write files to arbitrary locations (e.g., overwriting critical system files or deploying web shells).

Attack Flow:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The request includes a fileName parameter containing path traversal sequences (e.g., ../../etc/passwd).
3. The server processes the request and writes or reads the file at the attacker-specified path.
4. The attacker can then exfiltrate sensitive data or achieve code execution by uploading a malicious file (e.g., a JSP web shell) to a web-accessible directory.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following snippet from AccountHeadService.java illustrates the flaw:

// Vulnerable code (jshERP <= 3.6)
public void addAccountHeadAndDetail(MultipartFile file, String fileName) {
    String uploadDir = "/var/uploads/";
    // No validation of fileName
    File targetFile = new File(uploadDir + fileName);
    file.transferTo(targetFile);
}

A patched version would include validation to ensure the fileName does not contain path traversal sequences:

// Patched code (hypothetical)
public void addAccountHeadAndDetail(MultipartFile file, String fileName) {
    String uploadDir = "/var/uploads/";
    // Sanitize fileName to prevent path traversal
    String sanitizedFileName = new File(fileName).getName();
    File targetFile = new File(uploadDir + sanitizedFileName);
    file.transferTo(targetFile);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running jshERP <= 3.6 with the vulnerable endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/accountHead/addAccountHeadAndDetail).
2. Craft a multipart POST request with a malicious fileName parameter.
3. Use path traversal to read sensitive files or upload a web shell.

Example cURL command to read /etc/passwd:

curl -X POST \
  -F "file=@dummy.txt" \
  -F "fileName=../../etc/passwd" \
  http://target.com/api/accountHead/addAccountHeadAndDetail

Example cURL command to upload a JSP web shell:

curl -X POST \
  -F "file=@shell.jsp" \
  -F "fileName=../../webapps/ROOT/shell.jsp" \
  http://target.com/api/accountHead/addAccountHeadAndDetail

Note: The exact endpoint path may vary. Use reconnaissance to confirm.

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP requests to /api/accountHead/addAccountHeadAndDetail with suspicious fileName parameters containing ../ or ..\.
• Alert on file write operations outside the expected upload directory.
• Use file integrity monitoring (FIM) to detect unauthorized changes to web-accessible directories.

Response:

• Immediately isolate the affected server.
• Review logs for any successful exploitation attempts.
• Remove any unauthorized files (e.g., web shells).
• Apply temporary mitigations (e.g., WAF rules) until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/accountHead/addAccountHeadAndDetail with fileName containing ../ or ..\.
  • Outbound connections from the server to unknown IPs (potential data exfiltration).
• File System IOCs:
  • Unexpected files in web-accessible directories (e.g., shell.jsp, cmd.jsp).
  • Modified configuration files (e.g., application.properties, web.xml).
• Log IOCs:
  • Application logs showing file paths with traversal sequences.
  • Access logs with unusual fileName parameters.

Detection Engineering

YARA Rule

rule CVE_2026_11467_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in jshERP addAccountHeadAndDetail endpoint"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-11467"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "addAccountHeadAndDetail"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2026-11467 Path Traversal in jshERP
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts targeting the addAccountHeadAndDetail endpoint in jshERP
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'addAccountHeadAndDetail'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11467 jshERP Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"addAccountHeadAndDetail"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required for business operations.
2. Apply a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in the fileName parameter.
3. Restrict file upload permissions to the minimum necessary directories.

Long-Term Fix:

• Patch the application once the vendor releases a fix. Monitor the official jshERP repository for updates.
• Implement input validation for all file upload parameters, ensuring they do not contain path traversal sequences.
• Use a secure file upload library that automatically sanitizes file names.

Workaround:

• If patching is not possible, consider migrating to a different ERP solution or implementing a reverse proxy that validates file paths before forwarding requests to the backend.

Valters IT
DevSecOps & Cyber Threat Intelligence