qihang-wms CVE-2026-37430

Organizations running qihang-wms should immediately implement input validation on the ShopOrderImportController.java file upload endpoint to restrict accepted file types to legitimate business document formats (CSV, XLSX, XML) with server-side MIME type validation and content inspection. No vendor-released patch identified at time of analysis - the affected repository commit (75c15a) does not have a corresponding fix version documented in public sources or the NVD advisory. As a compensating control, configure web application firewall (WAF) rules to block uploads of executable file extensions (.jsp, .jspx, .war, .jar, .class) to the order import endpoint, though this may be bypassed via extension manipulation or MIME type confusion. More robust mitigation: restrict network access to the ShopOrderImportController endpoint to authenticated internal users only via reverse proxy authentication (this changes the attack surface from PR:N to PR:L, significantly reducing risk), and implement file upload to a sandboxed directory outside the web server's document root with separate processing workflow that never executes uploaded content directly. Monitor application logs for suspicious file upload attempts with unusual extensions or sizes. Organizations should evaluate migrating to actively maintained warehouse management solutions with established security development lifecycles, as qihang-wms appears to be a community project without formal security response process. Refer to researcher analysis at https://gist.github.com/Y4y17/6587147a37eba5b31de832e067f317ef for technical exploitation details to inform defensive configurations.