CVE-2026-11467 | jishenghua jshERP up to 3.6 addAccountHeadAndDetail Endpoint AccountHeadService.java fileName path traversal (Issue 154)

A vulnerability was found in jishenghua jshERP up to 3.6 and classified as critical. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal.

This vulnerability is documented as CVE-2026-11467. The attack can be executed remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.