CVE-2026-1549 | jishenghua jshERP up to 3.6 PluginController uploadPluginConfigFile configFile path traversal (Issue 146)

A vulnerability was found in jishenghua jshERP up to 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal.

This vulnerability is traded as CVE-2026-1549. The attack may be launched remotely. Furthermore, there is an exploit available.

The project was informed of the problem early through an issue report but has not responded yet.