CVE-2026-11470: hsweb-framework Path Traversal Flaw

CVE-2026-11470 Overview

CVE-2026-11470 is a path traversal vulnerability [CWE-22] in the hs-web hsweb-framework through version 5.0.1. The flaw resides in the denied function of hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java within the File Upload component. An authenticated remote attacker can manipulate the filename argument to traverse directories outside the intended upload path. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse against unpatched deployments. The project maintainers shipped a fix in commit 8009845b577d8a2c4bbf4fdd8e8913799a714be6 that adds stricter filename validation and rejects illegal paths.

Critical Impact
A remote, authenticated attacker can read or write files outside the upload directory by crafting filenames with traversal sequences, putting application data and integrity at risk.

Affected Products

hs-web hsweb-framework versions up to and including 5.0.1
The hsweb-system-file module (FileUploadProperties.java)
Applications built on hsweb-framework that expose the File Upload component

Discovery Timeline

2026-06-08 - CVE-2026-11470 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in the NVD database
Patch committed upstream as 8009845b577d8a2c4bbf4fdd8e8913799a714be6 (see GitHub Commit Changes)

Technical Details for CVE-2026-11470

Vulnerability Analysis

The vulnerability is a classic path traversal weakness [CWE-22] in the file upload handling code. The denied method in FileUploadProperties.java evaluates whether a submitted filename should be rejected, but the original logic does not normalize the filename or validate it against the configured upload directory boundary. An attacker who can submit an upload request can supply a filename containing relative traversal segments such as ../ or URL-encoded variants to escape the intended storage location.

The published EPSS value of 0.074% reflects low observed exploitation telemetry at this time, but a public disclosure already exists. Authentication is required, which limits remote reachability, yet the issue is meaningful in multi-tenant deployments where any authenticated user can upload files. Successful exploitation can lead to writing files into arbitrary directories within the application's filesystem permissions or reading files via subsequent retrieval flows, depending on how downstream handlers consume the validated filename.

Root Cause

The root cause is insufficient input sanitization of the filename argument inside the denied validation routine. The pre-patch code lacks Unicode normalization, URL decoding, and explicit checks for path separators or traversal sequences. As a result, attacker-controlled filenames flow into Path/Paths resolution logic without ensuring the resolved path stays inside the configured upload root.

Attack Vector

The attack is network-reachable and requires low privileges. An authenticated user issues a file upload request to an endpoint backed by hsweb-system-file, supplying a filename such as ../../etc/passwd or an encoded equivalent. Because the denied check fails to reject the traversal pattern, the framework treats the path as valid and the file operation executes outside the intended directory.

java

// Source: https://github.com/hs-web/hsweb-framework/commit/8009845b577d8a2c4bbf4fdd8e8913799a714be6
// Patch diff for FileUploadProperties.java - adds normalization, URL decoding,
// and AccessDenyException for illegal filenames.
 import lombok.Setter;
 import org.apache.commons.collections4.CollectionUtils;
 import org.hswebframework.utils.time.DateFormatter;
+import org.hswebframework.web.authorization.exception.AccessDenyException;
 import org.hswebframework.web.id.IDGenerator;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.http.MediaType;
 
 import java.io.File;
-import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.attribute.PosixFileAttributeView;
 import java.nio.file.attribute.PosixFilePermission;
-import java.util.Collections;
+import java.text.Normalizer;
 import java.util.Date;
 import java.util.Locale;
 import java.util.Set;

The patch introduces URLDecoder, Normalizer, InvalidPathException handling, and raises AccessDenyException when an illegal filename is detected.

Detection Methods for CVE-2026-11470

Indicators of Compromise

Upload requests containing ../, ..\, or URL-encoded variants such as %2e%2e%2f in the filename parameter
Files created in directories outside the configured hsweb upload root
Application logs showing Path resolution errors or unexpected absolute paths originating from upload handlers
Newly written files with executable extensions in web-accessible directories

Detection Strategies

Inspect HTTP request bodies and multipart uploads for traversal patterns in filename fields before they reach application handlers
Compare the canonical path of every uploaded file against the configured upload directory and alert on mismatches
Add runtime monitoring on the JVM process for file writes outside the expected upload base path
Review hsweb application logs for AccessDenyException events from FileUploadProperties after patching, which indicate blocked exploit attempts

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag traversal sequences in multipart form filenames
Forward filesystem auditing events from the upload directory and its parents to a centralized logging pipeline
Track authenticated user upload behavior for anomalies such as unusually long or encoded filenames

How to Mitigate CVE-2026-11470

Immediate Actions Required

Upgrade hsweb-framework to a release that includes commit 8009845b577d8a2c4bbf4fdd8e8913799a714be6
Audit existing upload directories for files placed outside the configured base path
Rotate credentials for any service accounts whose home directories are reachable from the application's filesystem context
Restrict the file upload endpoint to the minimum set of authenticated roles required

Patch Information

The upstream fix is published in the hs-web/hsweb-framework repository as commit 8009845b577d8a2c4bbf4fdd8e8913799a714be6. It adds URL decoding, Unicode normalization through java.text.Normalizer, and explicit rejection of invalid paths via AccessDenyException. Reference materials: GitHub Project Repository, GitHub Issue Tracker, and the VulDB CVE Entry.

Workarounds

Place a reverse proxy or WAF rule in front of upload endpoints to reject filenames containing ../, ..\, null bytes, or encoded traversal sequences
Run the application under a dedicated low-privilege OS account whose filesystem access is constrained to the upload directory
Enforce server-side filename rewriting that discards client-supplied paths and replaces them with generated identifiers
Disable or restrict the hsweb-system-file upload endpoint until the patch can be deployed

bash

# Example WAF rule (ModSecurity) to block traversal sequences in multipart filenames
SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" \
    "id:1026114701,phase:2,deny,status:400,log,msg:'Path traversal attempt in upload filename (CVE-2026-11470)',\
     chain"
    SecRule REQUEST_BODY "@rx (?:\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)" \
        "t:none,t:lowercase,t:urlDecodeUni"