CVE-2026-18903: Yeqifu Warehouse Path Traversal Flaw

CVE-2026-18903 Overview

CVE-2026-18903 is a path traversal vulnerability [CWE-22] in the yeqifu/warehouse project, affecting commits up to aaf29962ba407d22d991781de28796ee7b4670e4. The flaw resides in src/main/java/com/yeqifu/sys/controller/FileController.java, where the path argument is processed without adequate sanitization. Remote attackers with low privileges can manipulate the path parameter to access files outside the intended directory. The exploit has been publicly disclosed. The project uses a rolling release model, so no discrete fixed version is available. The vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can traverse the file system through the path argument in FileController.java and read files outside the intended scope.

Affected Products

yeqifu warehouse (rolling release)
Commits up to aaf29962ba407d22d991781de28796ee7b4670e4
Component: src/main/java/com/yeqifu/sys/controller/FileController.java

Discovery Timeline

2026-08-05 - CVE-2026-18903 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18903

Vulnerability Analysis

The vulnerability is a path traversal issue in the FileController.java component of the yeqifu/warehouse Java application. The controller accepts a user-controlled path argument and uses it in file operations without normalizing or validating the input against a permitted base directory. Because the application is a Java Spring-style web controller, the path parameter is exposed over HTTP, making the flaw reachable from the network. An attacker who has authenticated with low privileges can supply directory traversal sequences to reference files outside the intended file store.

Root Cause

The root cause is insufficient input validation on the path argument. The controller does not canonicalize the resolved path or verify that it remains within an allowed root directory. This aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation occurs over the network against the exposed HTTP endpoint in FileController.java. The attacker submits a crafted path value containing traversal sequences such as parent-directory references. The server resolves the path relative to the application context and returns or operates on the referenced file. Successful exploitation yields limited confidentiality impact, permitting the attacker to read files accessible to the application process. The vulnerability requires low privileges but no user interaction. A public proof of concept has been referenced through VulDB CVE-2026-18903.

Detection Methods for CVE-2026-18903

Indicators of Compromise

HTTP requests to endpoints handled by FileController.java containing directory traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f).
Access attempts to sensitive file paths such as /etc/passwd, WEB-INF/web.xml, or application configuration files through the path parameter.
Application logs showing file reads outside the configured upload or storage directory.

Detection Strategies

Inspect web server and application logs for requests that pass traversal patterns in the path query parameter.
Deploy WAF signatures for [CWE-22] traversal patterns targeting Java web application endpoints.
Correlate authenticated session activity with anomalous file read operations from the application service account.

Monitoring Recommendations

Enable verbose access logging on all FileController endpoints and forward logs to a centralized analytics platform.
Alert on file access events where the resolved canonical path falls outside the designated storage root.
Monitor for repeated 200-response file downloads following requests containing encoded traversal sequences.

How to Mitigate CVE-2026-18903

Immediate Actions Required

Restrict network exposure of the yeqifu/warehouse application to trusted internal networks until a patch is available.
Enforce authentication controls and reduce the number of accounts with access to endpoints handled by FileController.java.
Deploy a WAF rule blocking traversal patterns (../, ..\, %2e%2e%2f) against the affected endpoints.
Review recent application logs for evidence of prior exploitation attempts.

Patch Information

The vendor uses a rolling release model and no fixed release has been identified. The vendor did not respond to disclosure. Operators should audit FileController.java and apply local fixes that canonicalize the path argument using java.nio.file.Path#normalize() and verify the resolved path stays within an allowed base directory before file operations. Additional context is available in the VulDB Vulnerability #385940 entry and the Notion resource overview.

Workarounds

Place the application behind a reverse proxy that normalizes and rejects traversal sequences in request parameters.
Run the application under a low-privilege service account with file system access limited to the intended storage directory.
Apply mandatory access control (SELinux, AppArmor) policies restricting the process to its working directories.

bash

# Example WAF/nginx configuration to block path traversal on FileController requests
location ~* /sys/file {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
}