Sscms CVE-2026-4222

The CVSS v3.1 score of 3.8 reflects a low severity rating driven by multiple mitigating factors: the attack requires high privileges (PR:H, meaning authenticated admin access), has low attack complexity (AC:L), and impacts only integrity and availability without confidentiality impact (C:N/I:L/A:L). The vector indicates network-based attack (AV:N) with no user interaction required (UI:N). However, the CVSS score alone understates real-world risk because: (1) the exploit is publicly disclosed with available proof-of-concept code (E:P), increasing likelihood of weaponization; (2) the vulnerability is in an admin-facing API, making it particularly dangerous if administrator accounts are compromised via phishing, credential stuffing, or insider threats; (3) the vendor has not responded to early disclosure attempts (RL:X), indicating no official patch may be forthcoming and remediation depends on community forks or workarounds. SSVC analysis would classify this as moderate priority due to the combination of public POC availability, lack of vendor responsiveness, and the administrative context where exploitation directly impacts system integrity. This is not a critical remote code execution issue, but it represents a meaningful risk to SSCMS deployments where admin credentials are at risk.

An attacker who has obtained or been granted administrative credentials (either through social engineering, credential stuffing, or insider threat) logs into the SSCMS admin panel and navigates to the plugin installation feature. Instead of downloading a legitimate plugin, they craft a malicious request to /api/admin/plugins/install/actions/download with a path parameter containing traversal sequences such as ../../../../../../etc/passwd (on Linux) or ..\..\..\windows\win.ini (on Windows), exploiting the inadequate validation in PathUtils.RemoveParentPath to read sensitive configuration files or other sensitive data from the server. With write privileges, the attacker could potentially overwrite critical application files or configuration data, leading to denial of service or further system compromise.