EUVD-2026-92441
GHSA-3c9w-j4p9-9r6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach file-upload endpoint over network
-
DeliverySend upload with ../ traversal in path
-
ExploitWrite/retrieve file outside upload dir
-
ExecutionDrop web-executable payload
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the FileUploadController.local() file-upload handler in Unimall v4; the attacker must be able to reach this upload endpoint over the network and supply a filename/path containing directory-traversal sequences. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is required, but note this is unconfirmed against the vendor and should be validated, as many such controllers sit behind an admin/authenticated route. Escalation to code execution additionally depends on the traversal allowing a WRITE into a web-served/executable directory (vector encodes only confidentiality, consistent with read-only traversal); if only arbitrary file read is possible, impact is limited to information disclosure. Limiting factors: dependence on the application being deployed and exposed, the server mapping written files to an executable context, and the unverified affected-version scope. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) models this as a remotely reachable, low-complexity, unauthenticated flaw with HIGH confidentiality impact but NO integrity or availability impact - i.e. an arbitrary file-READ directory traversal. This directly CONFLICTS with the description and tags (RCE, 'execute arbitrary code'): true code execution would require integrity/availability impact (I:H/A:H), so either the NVD vector understates impact or the 'RCE' claim is aspirational for a traversal-based file write. VERIFY with vendor/source before treating this as unauthenticated RCE. On exploitation likelihood, EPSS is low at 0.24% (13th percentile) and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation; a public GitHub writeup/POC reference exists, which raises opportunistic risk but does not equal in-the-wild use. Net: this is a credible unauthenticated remote issue worth patching, but the combination of low EPSS, no KEV, and a niche product (Unimall) makes it a moderate rather than top-tier emergency priority. The single biggest open question is whether the real impact is file read (as the vector says) or file write leading to RCE (as the description says) - that determination should drive final prioritization. |
| Exploit ScenarioDerived | A remote attacker sends a crafted file-upload request to Unimall v4's FileUploadController.local() endpoint, embedding directory-traversal sequences (e.g. ../../) in the filename or path parameter. Per the description this lets the attacker place or access files outside the intended upload directory; if it enables writing a web-executable file (e.g. a JSP/servlet webshell) into a served path, it escalates to arbitrary code execution. A public writeup/POC is referenced on GitHub, lowering the skill barrier for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Path traversal in Unimall v4's FileUploadController.local() enables remote attackers to read arbitrary files outside the intended upload directory; the supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, though that remains unconfirmed against the vendor's actual routing. Although the description claims arbitrary code execution, the same vector shows only high confidentiality impact (C:H/I:N/A:N), so RCE would require an unconfirmed write-into-webroot capability; our independent assessment notes that if such a write is possible, integrity and availability impacts could follow. No public exploit or CISA KEV listing was identified, and EPSS is low at 0.24% (13th percentile).
RemediationAI
No vendor-released patch was identified at time of analysis. Until a fix is available, restrict network access to the FileUploadController.local() upload endpoint to trusted users or internal networks-this may break legitimate public upload functionality. Implement strict input validation by rejecting filenames containing traversal sequences (../, ..\, absolute paths, null bytes), canonicalizing the resolved path, and verifying it remains within the intended upload directory; thorough encoding-bypass testing is required because simple blacklists can be evaded. Store uploaded files outside the web root and serve them through a separate handler with execute permissions disabled; configure the web server so that no scripts can run from the upload directory. WAF rules blocking traversal patterns can provide limited defense but are bypassable. Monitor the vendor and the referenced NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-88392) and the GitHub advisory (https://github.com/fangtang7/CVE/blob/main/Unimall/file.md) for an official patch and version guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause: the FileUploadController.local() handler in Unimall v4 fails to properly sanitize or canonicalize user-supplied filenames/paths before using them in file operations. Unimall is a Java-based e-commerce platform, and file upload controllers often accept multipart requests and write to a configured local directory; traversal sequences (e.g., ../) can escape that base path. The attacker supplies a crafted filename or path parameter to the upload endpoint. Depending on whether the vulnerable code performs a read or a write, the traversal can expose configuration files, credentials, or source code (read), or place files outside the intended directory (write). CPE data is not available (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), and EUVD lists affected versions as 'n/a n/a', so the exact version scope within Unimall v4 is unconfirmed. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), reflecting a remotely reachable, low-complexity, unauthenticated read-only traversal; arbitrary code execution would require the write variant plus an executable web-served target directory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network file-upload traversal to arbitrary file write enabling code execution justifies full C/I/A:H; PR:N retained per input vector though authentication is unverified.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
Executive ViewAI
An unauthenticated path traversal flaw in Unimall v4's file-upload handling could let anyone on the internet read files stored on the server hosting the storefront, potentially exposing configuration files, secrets, or customer records. Because the affected component is typically internet-facing and the code base version places responsibility for mitigation on the deploying organization, leadership should treat this as an active exposure requiring interim containment rather than a vendor-timeline-driven fix. Exploitation likelihood is currently assessed as low, with no public exploit identified at time of analysis, so work can proceed on a controlled schedule while monitoring remains in place.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce WAF/reverse-proxy rules that reject traversal and encoded traversal patterns on the FileUploadController.local() route; restrict or disable that endpoint where the upload feature is not required; run the application under a least-privilege service account with read access confined to the upload directory and no write access to the webroot (a write capability would elevate this beyond file disclosure); segment the application host from internal data stores and secrets where feasible; and enable logging, alerting, and file-integrity monitoring to detect traversal attempts and unexpected reads. Treat all configuration and credential material on affected hosts as potentially exposed until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB