EUVD-2026-23417
GHSA-mrmx-7hg5-pj7x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/manage.php of the component Code Endpoint. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in Qihui jtbc5 CMS 5.0.3.6 allows authenticated remote attackers to read arbitrary files via a manipulated path parameter in /dev/code/common/diplomat/manage.php. The vulnerability has a published exploit and affects the Code Endpoint component; the vendor has not responded to early disclosure. With CVSS 4.3 and EPSS probability marked as Proof-of-Concept, this represents a moderate confidentiality risk limited to authenticated users.
Technical ContextAI
The vulnerability exists in the PHP-based jtbc5 CMS application, specifically within the Code Endpoint component's manage.php file. The flaw stems from insufficient input validation on the path parameter (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal weakness where user-supplied path inputs are not properly sanitized before being used in file system operations. An attacker with valid credentials can inject directory traversal sequences (e.g., '../') to escape the intended directory boundary and access files outside the application's intended scope. The CPE indicates all versions of jtbc5 CMS are covered in the vulnerability class, though only 5.0.3.6 is explicitly confirmed affected.
RemediationAI
No vendor-released patch has been identified at time of analysis, as the vendor did not respond to early disclosure contact. The primary mitigation is to immediately restrict access to the /dev/code/common/diplomat/manage.php endpoint via network-level controls: disable or remove the Code Endpoint component if not actively used, or implement Web Application Firewall (WAF) rules to block requests containing '../' or similar path traversal patterns in the path parameter. Within the application, implement strict input validation on the path parameter using a whitelist of allowed directory names and reject any input containing path traversal sequences. Apply principle of least privilege to the CMS application's file system permissions - ensure the PHP process runs with minimal necessary file access and cannot read sensitive system files even if traversal is exploited. Monitor access logs for suspicious path parameter values. Consider upgrading to a newer CMS version if available from Qihui, or evaluate alternative CMS solutions if the vendor remains unresponsive. Each mitigation trades some functionality (WAF rules may block legitimate uses) against immediate security; path traversal mitigations are generally low-impact for legitimate users.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today