kerwincui FastBee EUVD-2026-26810

Exploitation requires valid authentication credentials for kerwincui FastBee - the attacker must first gain or obtain authenticated user access (PR:L in CVSS vector). The vulnerability is NOT exploitable against default unauthenticated configurations; all users of the system (including low-privilege roles such as guest or read-only users) can trigger the path traversal if they have any access to the download endpoint. The specific condition triggering exploitability is the absence of input validation on the fileName parameter combined with the application's direct use of this parameter to construct filesystem paths without canonical path resolution. No special application configuration or non-default settings are required; the vulnerability is present in standard deployments of FastBee 1.2.1 and earlier. The attacker is limited by operating system file permissions - they cannot read files outside the privilege context of the FastBee Java process (typically the application service account), so system files readable only by root may be inaccessible. The exploitation does not modify files (I:N), crash the application (A:N), or require user interaction (UI:N), but does require the target to be network-accessible and the attacker to possess valid credentials.

While CVSS 4.3 indicates low severity, the risk assessment reveals important nuances. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates remote network access with low attack complexity, but requires authenticated privileges (PR:L), limiting the attacker pool to users with valid credentials. The confidentiality impact is rated as low (C:L), meaning file disclosure is confined to readable files rather than sensitive system data. However, the E:P (Exploit POC Published) rating and availability of public exploit code elevates practical risk for organizations still running unpatched FastBee instances. The absence of vendor response (RL:X) and unconfirmed remediation guidance increase operational uncertainty. Real-world risk depends heavily on deployment context: if FastBee authenticates to external identity providers or has weak credential controls, exploitation becomes more probable. SSVC decision framework would rate this as Publish/Act-Now for environments with high user-to-application trust boundaries but lower priority for air-gapped or tightly controlled deployments. The low CVSS versus public POC availability suggests this is not a widespread mass-exploitation threat but rather a targeted abuse vector for disgruntled users or lateral movement within compromised environments.

An authenticated user with valid FastBee credentials (e.g., a regular employee or guest account) sends a crafted HTTP GET request to the download endpoint with a malicious fileName parameter such as 'fileName=../../etc/passwd' or 'fileName=../../../config/application.properties' (URL-encoded as needed). The ToolController.download function processes this parameter without validation and resolves it against the server filesystem, allowing the attacker to read sensitive files such as database credentials stored in configuration files, private SSH keys, or application source code. The attacker downloads and exfiltrates these files, potentially gaining further access or discovering other vulnerabilities in the application stack. Public exploit code referenced in the advisory removes the need for custom payload crafting, lowering the barrier to exploitation for non-technical actors.