CVE-2026-2684

HIGH

Tsinghua Unigroup EA <=3.2.210802 - Unrestricted Upload

Title source: llm

Description

A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

[Permissions Required, VDB Entry] https://vuldb.com/?id.346475

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.346475

[Permissions Required, VDB Entry] https://vuldb.com/?submit.753973

[Various Sources] https://github.com/luoye197-prog/ziguang-fileupload

View Writeup ZIP pw:eip

[Various Sources] https://github.com/luoye197-prog/ziguang-fileupload/blob/main/introduce%26poc

Scores

CVSS v3 7.3

EPSS 0.0002

EPSS Percentile 4.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-284 CWE-434

Status published

Products (1)

unigroup/electronic_archives_system < 3.2.210802\(62532\)

Published Feb 19, 2026

Tracked Since Feb 19, 2026