EUVD-2026-66701
GHSA-5554-h45w-9f98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach DocSys upload endpoint
-
DeliveryPOST webshell via uploadMarkdownPic
-
ExploitBypass image validation
-
InstallFile stored in web root
-
C2Request uploaded file URL
-
ExecuteExecute code as web app user
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the uploadMarkdownPic file-upload handler in DocController.java of DocSys V2.02.85; the attacker must be able to reach this Markdown-picture upload endpoint over HTTP and the application must store the uploaded file in a web-accessible, container-executable location for RCE to result. The CVSS vector asserts PR:N/UI:N (no authentication, no user interaction), but this is NOT corroborated by the description - a Markdown-picture upload feature commonly requires an authenticated document-editor session, so authentication may in practice be a limiting factor. Exploitation is further limited to deployments running the affected DocSys V2.02.85 build (or nearby versions) where server-side upload validation is absent. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) portrays a trivially exploitable, unauthenticated, network-reachable RCE. However, that severity is in tension with the other signals: EPSS is only 0.14% (4th percentile) and the CVE is absent from CISA KEV, so real-world exploitation appears targeted-or-theoretical rather than mass-scanned. There is no SSVC record in the input, but a reasonable read is Exploitation=PoC (write-up exists), Automatable=likely no (specific endpoint, single niche product), Technical Impact=Total. The most important caveat is the PR:N claim: an endpoint named uploadMarkdownPic typically lives behind an authenticated document-editing session, and the description does not confirm the endpoint is reachable pre-authentication - verify with the vendor/source before treating this as fully unauthenticated. If authentication is in fact required, effective severity drops toward the high (not critical) range. Net: a genuine RCE-class bug worth prompt patching for anyone running DocSys, but the combination of a niche product, low EPSS, and no KEV means it is not a drop-everything, internet-wide emergency. |
| Exploit ScenarioDerived | An attacker with reach to the DocSys web interface crafts a request to the uploadMarkdownPic endpoint supplying a JSP webshell disguised as (or in place of) a Markdown image, then requests the stored file's URL to execute commands on the server as the web application user. Public reproduction steps are documented in the linked GitHub write-up, lowering the effort required. Per the CVSS vector this is a low-complexity network attack, though whether an authenticated session is first required is not confirmed in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Arbitrary file upload in DocSys-master V2.02.85 lets remote attackers upload malicious files through the uploadMarkdownPic interface in DocController.java, bypassing intended image-only restrictions on the Markdown picture-upload endpoint. Because a webshell or other executable payload can be written into a web-accessible path, this can escalate to full server compromise and remote code execution. Publicly available exploit code exists (a GitHub write-up with reproduction steps); it is not listed in CISA KEV and EPSS is low (0.14%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so treat mitigation as compensating controls until the DocSys maintainers publish a fix. The primary technical control is to lock down the uploadMarkdownPic handler: enforce a strict server-side allow-list of image extensions and MIME/magic-byte checks, reject any file whose name contains executable extensions (.jsp/.jspx/.war/.class) or path-traversal sequences, and rename uploads to random identifiers. Critically, store uploaded pictures outside the servlet web root (or in a location served with a static/no-execute handler) so uploaded content can never be executed by the container - side effect: application code that references the old path may need adjustment. As a network control, restrict access to the document-editing and upload endpoints to authenticated, trusted users via a reverse proxy or WAF rule blocking uploads with non-image content types; the trade-off is potential false positives on legitimate large or unusual image assets. Monitor the write-up at github.com/fangtang7/CVE and the DocSys project for an official patched release and upgrade as soon as one is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DocSys is an open-source Java-based document/knowledge management system (Spring MVC controller layer, per src/com/DocSystem/controller/DocController.java). The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the uploadMarkdownPic handler, intended to accept only image assets embedded in Markdown documents, does not adequately validate file extension, content type, or storage location. When a Java web application persists an attacker-controlled file (e.g., a .jsp payload) inside the servlet container's web root, that file becomes directly requestable and can be executed by the container, turning a benign 'attach a picture' feature into a code-execution primitive. The CPE (cpe:2.3:a:n/a:n/a:*) carries no usable vendor/product identifier, so exact affected-component matching must be derived from the description rather than NVD CPE data.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network file-upload to web-root yields full RCE (C/I/A High), but a Markdown-picture editor endpoint plausibly requires a low-privileged authenticated session, so PR:L rather than PR:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:
Executive ViewAI
DocSys V2.02.85 exposes organizations to complete server compromise through an unprotected file upload mechanism accessible to any remote, unauthenticated user. Publicly available exploit code exists, with no patch currently available from the vendor, creating significant operational and data security risk for teams using DocSys.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict network access to the DocSys upload endpoint using firewall rules or network segmentation; (2) implement web application firewall rules to block file uploads with suspicious extensions (e.g., .jsp, .exe, .sh, .php); (3) enforce strict file type validation at application level; (4) disable uploadMarkdownPic feature if not operationally required; (5) monitor server logs and upload directories for unauthorized files; (6) enable detailed logging of all upload attempts for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB