Is there a public PoC exploit available for CVE-2026-11467?

Yes, a public proof-of-concept exploit is available for CVE-2026-11467. Prioritise patching immediately. EPSS: 0.1%.

jshERP CVE-2026-11467

Q: What is the CVSS score of CVE-2026-11467?

CVE-2026-11467 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34998 LOW

Path Traversal (CWE-22)

2026-06-07 VulDB

GHSA-h9vf-m6r3-vxmh

Path Traversal Java Jsherp

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 00:22 NVD

5.4 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 07, 2026 - 23:59 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in jishenghua jshERP up to version 3.6 allows authenticated remote attackers to manipulate the fileName argument at the addAccountHeadAndDetail endpoint, producing limited but confirmed integrity and availability impacts (I:L/A:L). The vulnerability is in AccountHeadService.java within the Java ERP application, and a proof-of-concept exploit has been publicly disclosed via the project's GitHub issue tracker. The vendor had not responded to the responsible disclosure at time of reporting, and no patch is available.

Technical ContextAI

jshERP is an open-source Java-based ERP system (CPE: cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*) hosted on GitHub. The vulnerability maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), meaning the addAccountHeadAndDetail function in jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java accepts a user-supplied fileName argument without adequately sanitizing directory traversal sequences (e.g., ../). This allows an attacker to reference or write to filesystem paths outside the application's intended working directory. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires low complexity, and demands only a low-privilege authenticated session - consistent with a standard ERP user account.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor had not responded to the issue report filed at https://github.com/jishenghua/jshERP/issues/154 as of disclosure. Organizations should monitor that GitHub issue and the repository at https://github.com/jishenghua/jshERP/ for any forthcoming fix. As compensating controls: restrict the addAccountHeadAndDetail endpoint to trusted internal network segments or authenticated VPN-only access to reduce the attack surface (trade-off: may disrupt remote ERP workflows); deploy a web application firewall rule to reject fileName values containing ../, ..\, or URL-encoded traversal sequences (%2e%2e) before they reach the application (trade-off: pattern-matching bypasses are possible if the WAF ruleset is incomplete); and harden the operating system account under which jshERP runs by confining its filesystem permissions to only the specific directories required for legitimate file operations using OS-level access controls, so that even a successful traversal cannot escape the permitted scope.