Is there a public PoC exploit available for EUVD-2026-26807?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26807. Prioritise patching immediately. EPSS: 0.0%.

crmeb_java EUVD-2026-26807

Q: What is the CVSS score of EUVD-2026-26807?

EUVD-2026-26807 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7673 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-03 VulDB

Java File Upload

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:19 vuln.today

Public exploit code

Severity Changed

May 03, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

May 03, 2026 - 02:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 03, 2026 - 02:14 vuln.today

EUVD ID Assigned

May 03, 2026 - 02:00 euvd

EUVD-2026-26807

Analysis Generated

May 03, 2026 - 02:00 vuln.today

CVE Published

May 03, 2026 - 01:15 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in crmeb_java Admin Upload component (versions up to 1.3.4) allows high-privileged remote attackers to upload arbitrary files by manipulating the model argument in UploadServiceImpl.java, resulting in potential code execution or system compromise. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability exists in the file upload handling logic of crmeb_java's Admin Upload component, specifically within UploadServiceImpl.java. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates that the application accepts file uploads without proper validation or restrictions on file type, size, or content. The vulnerability stems from insufficient input validation on the model argument passed to the upload function, allowing attackers with high-level administrative privileges to manipulate upload parameters and bypass security controls that would normally restrict file types or destinations. This Java-based CRM/e-commerce system exposes this functionality via remote network access.

RemediationAI

Upgrade crmeb_java to a version beyond 1.3.4 as soon as a patched version is released; however, no vendor-released patch version has been publicly confirmed at this time. Given the vendor's non-responsiveness to early disclosure, monitor VulDB and the project repository for security updates. As an immediate compensating control, restrict network access to the Admin Upload endpoint (UploadServiceImpl) to trusted internal networks only using firewall rules or reverse proxy authentication. Implement strict file upload validation including: whitelist allowed file extensions, enforce file type verification via MIME type and magic number inspection, store uploaded files outside the web root to prevent direct execution, and apply strict access controls to the /crmeb/crmeb-service/ endpoints. These controls mitigate exploitation risk while awaiting a vendor patch, though they require administrative access to implement and may impact legitimate administrative workflows.