CVE-2026-4542

MEDIUM

SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal

Title source: cna
STIX 2.1

Description

A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

References (7)

Core 7
Core References
Vdb Entry, Technical Description
VDB-352359 | SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal
https://vuldb.com/?id.352359
Signature, Permissions Required
VDB-352359 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/?ctiid.352359
Third Party Advisory
Submit #774689 | SSCMS V4.7.0 SSCMS Arbitrary File Deletion
https://vuldb.com/?submit.774689
Vdb Entry, Technical Description vdb-entry technical-description
VDB-352359 | SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal
https://vuldb.com/vuln/352359
Signature, Permissions Required signature permissions-required
VDB-352359 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/352359/cti
Third Party Advisory third-party-advisory
Submit #774689 | SSCMS V4.7.0 SSCMS Arbitrary File Deletion
https://vuldb.com/submit/774689

Scores

CVSS v3 5.4
EPSS 0.0031
EPSS Percentile 22.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
None/SSCMS 4.7.0
n/a/SSCMS 4.7.0
Published Mar 22, 2026
Tracked Since Mar 22, 2026