Tsinghua Unigroup Electronic Archives System CVE-2026-2684
MEDIUMCVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Electronic Archives System versions up to 3.2.210802 is affected by improper access control (CVSS 7.3).
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Electronic Archives System instances and their versions; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict access to the Archives System; deploy WAF rules to block suspicious access patterns; enable enhanced logging and monitoring for unauthorized access attempts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today