Which versions of Java are affected by CVE-2026-4201?

An unauthenticated file upload vulnerability in the glowxq-oj online judge system allows attackers to upload malicious files without authentication, with public exploit code already available.

Is there a public PoC exploit available for CVE-2026-4201?

Yes, a public proof-of-concept exploit is available for CVE-2026-4201. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4201?

Within 24 hours: Immediately disable the SysFileController Upload function or restrict access via network/WAF rules; audit recent file uploads for suspicious activity. Within 7 days: Implement compensating controls (WAF rules blocking upload endpoints, IP whitelisting, authentication enforcement); assess if alternative online judge solutions are available. Within 30 days: Evaluate migration to patched version once available; conduct full security assessment of the affected system and related infrastructure.

Java CVE-2026-4201

Q: What is the CVSS score of CVE-2026-4201?

CVE-2026-4201 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12273 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-16 VulDB

Java File Upload

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 02:00 euvd

EUVD-2026-12273

Analysis Generated

Mar 16, 2026 - 02:00 vuln.today

CVE Published

Mar 16, 2026 - 00:32 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file business/business-system/src/main/java/com/glowxq/system/admin/controller/SysFileController.java. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

An unrestricted file upload vulnerability exists in the glowxq-oj online judge system that allows remote attackers without authentication to upload malicious files through the SysFileController Upload function. A proof-of-concept exploit is publicly available, and while not currently in CISA's KEV catalog, the vulnerability poses moderate risk with a CVSS score of 7.3 and publicly disclosed exploitation code.

Technical ContextAI

The vulnerability affects glowxq-oj (CPE: cpe:2.3:a:glowxq:glowxq-oj:*:*:*:*:*:*:*:*), an online judge system written in Java. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and exists in the Upload function within SysFileController.java at path business/business-system/src/main/java/com/glowxq/system/admin/controller/. This type of vulnerability occurs when an application fails to properly validate uploaded files for type, size, or content, potentially allowing attackers to upload executable code or other malicious files.

RemediationAI

No patch is currently available. The vendor was contacted early about this disclosure but did not respond. Immediate mitigations include: 1) Implement strict file type validation and whitelist allowed extensions, 2) Add file content verification beyond extension checking, 3) Store uploaded files outside the web root, 4) Implement authentication and authorization checks on the upload endpoint, 5) Consider disabling the vulnerable upload functionality until a proper fix can be implemented. Monitor VulDB entry 351113 for potential updates.