CVE-2026-1588 | jishenghua jshERP up to 3.6 installByPath install path path traversal (Issue 147)

A vulnerability classified as problematic was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal.

This vulnerability is known as CVE-2026-1588. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.