CVE-2026-2953 | Dromara UJCMS 101.2 Template WebFileTemplateController.delete deleteDirectory path traversal

A vulnerability was found in Dromara UJCMS 101.2. It has been declared as critical. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal.

This vulnerability is listed as CVE-2026-2953. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.