Is there a public PoC exploit available for CVE-2026-7024?

Yes, a public proof-of-concept exploit is available for CVE-2026-7024. Prioritise patching immediately. EPSS: 0.1%.

rawchen sims CVE-2026-7024

Q: What is the CVSS score of CVE-2026-7024?

CVE-2026-7024 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25699 LOW

Path Traversal (CWE-22)

2026-04-26 VulDB

Java Path Traversal

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 26, 2026 - 07:45 vuln.today

CVSS changed

Apr 26, 2026 - 07:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 26, 2026 - 07:15 euvd

EUVD-2026-25699

Analysis Generated

Apr 26, 2026 - 07:15 vuln.today

CVE Published

Apr 26, 2026 - 06:45 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de. Affected by this issue is some unknown functionality of the file sims-master/src/web/servlet/file/DeleteFileServlet.java of the component deleteFileServlet Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in rawchen sims DeleteFileServlet endpoint allows authenticated remote attackers to manipulate the filename parameter and access arbitrary files on the system, potentially leading to information disclosure or file modification. The vulnerability affects all versions up to commit 004f783b1db5ecdfad81c8fdc3b34171211112de, with publicly available exploit code and no vendor response to early disclosure notification.

Technical ContextAI

The vulnerability exists in the DeleteFileServlet Java servlet component (sims-master/src/web/servlet/file/DeleteFileServlet.java) which handles file deletion operations via HTTP endpoints. The root cause is improper validation of the filename parameter (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), allowing attackers to use path traversal sequences (such as ../ or absolute paths) to reference files outside the intended deletion directory. This is a classic input validation flaw in file operation handlers where user-supplied path data is not sanitized before being passed to filesystem operations.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor did not respond to early disclosure contact. Immediate mitigation options include: (1) Implement strict input validation on the filename parameter by rejecting any input containing path traversal sequences (../, ..\, absolute paths beginning with / or drive letters), (2) Use a whitelist-based approach where only pre-approved filenames are permitted for deletion, (3) Restrict the DeleteFileServlet endpoint to a specific safe directory and use SecurityManager or servlet filters to prevent directory traversal, (4) Disable the DeleteFileServlet endpoint entirely if file deletion is not critical functionality, or (5) Apply network segmentation to limit access to the servlet to trusted administrative interfaces only. Organizations should monitor git repositories for security forks or community patches, consider migrating to alternative maintained products, or conduct a code audit to implement compensating controls directly in the application.