Java CVE-2026-6105

Q: What is the CVSS score of CVE-2026-6105?

CVE-2026-6105 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21684 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-04-11 cna@vuldb.com

Java Information Disclosure

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Apr 11, 2026 - 22:27 vuln.today

EUVD ID Assigned

Apr 11, 2026 - 22:22 euvd

EUVD-2026-21684

Analysis Generated

Apr 11, 2026 - 22:22 vuln.today

CVE Published

Apr 11, 2026 - 22:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in perfree go-fastdfs-web up to version 1.3.7 allows remote unauthenticated attackers to access the doInstall interface in InstallController.java, potentially disclosing sensitive information or manipulating system configuration. The vulnerability has been publicly disclosed with exploit code available; however, the vendor has not responded to early disclosure notifications and no official patch has been released.

Technical ContextAI

The vulnerability exists in the InstallController.java component, specifically the doInstall interface endpoint, which fails to properly validate authorization before processing requests (CWE-266: Improper Privilege Management). This Java-based web application component lacks sufficient access controls on what should be a privileged administrative function. The go-fastdfs-web project is a file distribution system written in Java, and the affected InstallController is responsible for system installation procedures that should be restricted to authorized administrators. The improper authorization flaw allows the interface to accept and process requests from unauthenticated remote sources without verifying the caller's privileges or installation state, enabling unauthorized manipulation of system configuration.

RemediationAI

No vendor-released patch identified at time of analysis. Users should implement network-level access controls to restrict access to the doInstall endpoint to trusted administrative networks only, or disable the endpoint entirely if the installation process has already completed. Consider placing the go-fastdfs-web application behind a Web Application Firewall (WAF) with rules that require authentication tokens or IP whitelisting before reaching InstallController endpoints. Monitor for any updates from the perfree project; given vendor non-responsiveness, upgrade to a patched version if one becomes available in the project repository. As an interim measure, review access logs for any unauthorized attempts to invoke the doInstall interface and verify the integrity of your installation configuration.