CVE-2026-11470

MEDIUM

hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal

Title source: cna
STIX 2.1

Description

A vulnerability has been found in hs-web hsweb-framework up to 5.0.1. The affected element is the function denied of the file hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java of the component File Upload. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8009845b577d8a2c4bbf4fdd8e8913799a714be6. It is suggested to install a patch to address this issue.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-369090 | hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal
https://vuldb.com/vuln/369090
Signature, Permissions Required signature permissions-required
VDB-369090 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369090/cti
Third Party Advisory third-party-advisory
CVE-2026-11470 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11470
Third Party Advisory third-party-advisory
Submit #833856 | GitHub hsweb-framework 5.0.0 Path Traversal: '../filedir'
https://vuldb.com/submit/833856

Scores

CVSS v3 6.3
EPSS 0.0042
EPSS Percentile 33.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
hs-web/hsweb-framework 5.0.0
hs-web/hsweb-framework 5.0.1
Published Jun 08, 2026
Tracked Since Jun 08, 2026