Is there a public PoC exploit available for EUVD-2026-53047?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53047. Prioritise patching immediately. EPSS: 0.4%.

yeqifu warehouse EUVD-2026-53047

Q: What is the CVSS score of EUVD-2026-53047?

EUVD-2026-53047 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-18903 LOW

Path Traversal (CWE-22)

2026-08-05 VulDB

GHSA-mfcv-f6vv-6h4c

Java Path Traversal Warehouse Yeqifu

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication; only limited file read achieved with no integrity or availability impact, so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Aug 05, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 05, 2026 - 05:59 vuln.today

CVE Published

Aug 05, 2026 - 04:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in yeqifu warehouse (all commits up to aaf29962ba407d22d991781de28796ee7b4670e4) enables authenticated remote attackers to read arbitrary files outside the intended web root by supplying directory-traversal sequences in the path argument handled by FileController.java. The exploit has been publicly disclosed and proof-of-concept code is available via VulDB and an external Notion document, raising the urgency despite a moderate CVSS 4.0 score of 5.3. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving all deployments of this Java-based warehouse management application unmitigated.

Technical ContextAI

The affected component is src/main/java/com/yeqifu/sys/controller/FileController.java in the yeqifu warehouse application (CPE: cpe:2.3:a:yeqifu:warehouse:*:*:*:*:*:*:*:*), a Java-based warehouse management system. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the root cause: the path parameter accepted by the file controller endpoint is passed to file-system operations without adequate canonicalization or boundary enforcement. Attackers can inject sequences such as ../ to escape the intended directory and reference files anywhere the application process has read access. The CVSS 4.0 vector (E:P) confirms a public exploit exists, and the rolling-release model means there is no stable version tag against which a fix can be tracked.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and the rolling-release model provides no tagged fix version. Organizations running yeqifu warehouse should immediately implement server-side input validation that canonicalizes the path parameter and enforces that the resolved path remains within an explicitly defined allowed directory (e.g., using Java's Path.normalize() followed by startsWith() against the base directory). As a compensating control, restrict the application process account's filesystem permissions to only the directories it legitimately requires, limiting the blast radius of successful traversal. Consider deploying a WAF rule to block requests containing ../ or encoded traversal sequences (%2e%2e%2f) targeting the file controller endpoint. Given the public exploit, restricting network access to the application to trusted IP ranges or VPN is advisable as a short-term containment measure. Monitor VulDB entry https://vuldb.com/vuln/385940 for any future patch release.