A vulnerability identified as critical has been detected in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is the function
Download of the file /Search/Subject/downLoad. Performing a manipulation of the argument path results in path traversal.
This vulnerability is reported as CVE-2026-2672. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
