A vulnerability, which was classified as critical, has been found in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function
uploadFile of the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java. The manipulation of the argument fileName leads to unrestricted upload.
This vulnerability is listed as CVE-2026-3797. The attack may be initiated remotely. In addition, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
