CVE-2026-4222 | SSCMS up to 7.4.0 download PathUtils.RemoveParentPath path path traversal

A vulnerability marked as critical has been reported in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal.

This vulnerability is registered as CVE-2026-4222. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.