CVE-2026-11467: jshERP Path Traversal Vulnerability

CVE-2026-11467 Overview

CVE-2026-11467 is a path traversal vulnerability [CWE-22] in jishenghua jshERP up to version 3.6. The flaw resides in the addAccountHeadAndDetail function within jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java. An authenticated remote attacker can manipulate the fileName argument to traverse directories outside the intended path. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse. The maintainer was notified through an issue report but has not responded at the time of disclosure.

Critical Impact
Authenticated attackers can read or write files outside the intended directory by supplying crafted fileName values to the addAccountHeadAndDetail endpoint, exposing application data and configuration.

Affected Products

jishenghua jshERP versions up to and including 3.6
Component: addAccountHeadAndDetail endpoint
File: jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java

Discovery Timeline

2026-06-08 - CVE-2026-11467 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11467

Vulnerability Analysis

The vulnerability exists in the addAccountHeadAndDetail function of the AccountHeadService.java service class in jshERP. The function accepts a fileName argument from a remote request and uses it in file operations without validating or canonicalizing the path. Attackers supply traversal sequences such as ../ to escape the intended directory and reference arbitrary file system locations. The issue is classified as path traversal [CWE-22].

Exploitation requires only low-privilege authentication, since the endpoint is reachable over the network. According to the disclosure, exploit details have been published, which lowers the barrier to abuse. The impact is constrained to limited confidentiality, integrity, and availability effects on the targeted application files rather than the broader system.

Root Cause

The root cause is missing input validation on the fileName parameter passed to addAccountHeadAndDetail. The application concatenates user-controlled input into a file path without enforcing an allowlist, rejecting traversal sequences, or resolving the canonical path against a trusted base directory. This pattern allows traversal characters to alter the resolved location.

Attack Vector

The attack vector is network-based. An authenticated user issues a crafted HTTP request to the addAccountHeadAndDetail endpoint with a fileName value containing directory traversal sequences. The server then resolves the path outside the intended directory during file handling. No user interaction is required, and the attack does not require elevated privileges. Technical details and submission references are available in the VulDB Vulnerability Details and the GitHub Issue Tracker.

Detection Methods for CVE-2026-11467

Indicators of Compromise

HTTP requests to the addAccountHeadAndDetail endpoint containing ../, ..\, or URL-encoded equivalents (%2e%2e%2f) in the fileName parameter.
File access events from the jshERP Java process targeting paths outside the application's designated upload or accounting directory.
Unexpected file creation, modification, or read activity in system directories tied to the jshERP service account.

Detection Strategies

Inspect web server and application logs for requests to /addAccountHeadAndDetail with suspicious fileName values, including encoded traversal patterns.
Deploy WAF rules that block directory traversal sequences in POST bodies and query parameters targeting jshERP endpoints.
Correlate authenticated session activity with anomalous file system access by the jshERP JVM process.

Monitoring Recommendations

Enable verbose logging on the AccountHeadService controller and forward logs to a centralized analytics platform for retention and search.
Alert on outbound file access by the jshERP process that crosses configured directory boundaries.
Monitor the project's GitHub Issue Tracker and VulDB CVE Report for patch availability and updated indicators.

How to Mitigate CVE-2026-11467

Immediate Actions Required

Restrict network access to the jshERP application so that only trusted users and networks can reach the addAccountHeadAndDetail endpoint.
Revoke or rotate credentials for low-privilege accounts that no longer require access to file upload functionality.
Deploy WAF or reverse proxy rules to block traversal sequences in requests to the affected endpoint until an upstream fix is released.

Patch Information

No official vendor patch is available at the time of writing. According to the disclosure, the project maintainer was informed through an issue report but has not responded. Track the GitHub Project Repository and GitHub Issue Tracker for updates. Additional context is available in the VulDB CVE Report.

Workarounds

Validate the fileName parameter at the reverse proxy or WAF layer by rejecting any value containing .., absolute paths, or non-ASCII path separators.
Run the jshERP Java process under a dedicated low-privilege OS account with file system permissions limited to the application's working directories.
Apply mandatory access controls (SELinux, AppArmor) to confine the jshERP service to its expected file paths.

bash

# Example ModSecurity rule to block path traversal on the affected endpoint
SecRule REQUEST_URI "@contains /addAccountHeadAndDetail" \
    "id:1026114670,phase:2,deny,status:403,\
    chain,msg:'CVE-2026-11467 path traversal attempt in fileName'"
    SecRule ARGS:fileName "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase,t:urlDecodeUni"