cjbi admin3 CVE-2026-75339

Upload exploitation requires a valid authenticated session with any privilege level in cjbi admin3 v3.0.0 - there is no role or permission requirement beyond being logged in (CVSS PR:L confirms this). The /storage/upload endpoint must be network-accessible, which is the default deployment posture for a web admin application. The anonymous download vector requires no credentials whatsoever; any network-reachable actor can retrieve stored files. Limiting factors: an attacker must obtain at least one valid user credential for the upload phase - unauthenticated upload is not described. Remote code execution as a follow-on requires the web server to execute the uploaded file type (e.g., JSP), which depends on application server configuration. The vulnerability does not apply to versions other than v3.0.0, and non-default network isolation (e.g., intranet-only deployment) would reduce external exposure for the download vector.

CVSS scores this at 8.8 High, driven by full C/I/A impact and network accessibility, which accurately reflects the potential for arbitrary file upload enabling webshell deployment or data exposure. However, EPSS at 0.15% (4th percentile) is notably low, suggesting the product's limited deployment footprint suppresses real-world exploitation rates rather than indicating the flaw is hard to exploit. There is no CISA KEV listing. A researcher-authored write-up exists on GitHub (fangtang7/CVE repository), which constitutes publicly available exploit documentation but not confirmed weaponized tooling. The gap between high CVSS and very low EPSS is consistent with a severe flaw in a niche, low-prevalence product - organizations running admin3 v3.0.0 face genuine High-severity risk; the global threat surface is narrow. No conflicting signals between CVSS and description: the PR:L upload vector and anonymous download vector are both consistent with the endpoint behaviour described.

An attacker with any valid user account - including a freshly registered or compromised low-privilege account - sends a multipart POST request to /storage/upload containing a server-side script (e.g., a JSP webshell). The server stores the file without type or permission validation. The attacker - or any anonymous third party - then retrieves the uploaded file via the unauthenticated download endpoint and, if the web server executes the file type, achieves remote code execution under the application's process identity. Researcher documentation on GitHub provides technical detail sufficient to replicate the upload/download sequence.