CVE-2026-2953: Ujcms Path Traversal Vulnerability

CVE-2026-2953 Overview

A path traversal vulnerability has been identified in Dromara UJCMS version 10.1.2. This security flaw affects the deleteDirectory function within the WebFileTemplateController.delete component of the Template Handler. The vulnerability allows attackers to manipulate file paths to traverse outside intended directories, potentially leading to unauthorized file deletion or access. This vulnerability is network-exploitable and has been publicly disclosed, with exploit information already available. Notably, the vendor was contacted regarding this disclosure but did not respond.

Critical Impact

Remote attackers with low privileges can exploit this path traversal vulnerability to potentially delete arbitrary files or directories on the target system, compromising data integrity and system availability.

Affected Products

• Dromara UJCMS 10.1.2
• UJCMS Template Handler component
• WebFileTemplateController.delete functionality

Discovery Timeline

• 2026-02-22 - CVE-2026-2953 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-2953

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw resides in the Template Handler component of UJCMS, specifically within the file deletion functionality. When processing delete requests through the WebFileTemplateController.delete endpoint, the application fails to properly sanitize user-supplied path inputs before passing them to the deleteDirectory function.

The network-based attack vector means that any authenticated user with access to the template management functionality could potentially exploit this vulnerability remotely. The exploitation requires low privilege levels, making it accessible to regular authenticated users rather than requiring administrative access.

Root Cause

The root cause of this vulnerability stems from insufficient input validation in the deleteDirectory function. The application does not properly sanitize or validate file path parameters before performing file system operations. This allows attackers to inject directory traversal sequences (such as ../) into the file path parameter, enabling them to escape the intended template directory and access or delete files in arbitrary locations on the server's file system.

The absence of path canonicalization and boundary checks allows malicious input to be processed directly, bypassing the intended directory restrictions of the template management system.

Attack Vector

The attack can be performed remotely over the network by an authenticated user with low-level privileges. An attacker would craft a malicious HTTP request to the WebFileTemplateController.delete endpoint, including path traversal sequences in the file path parameter. By manipulating the path with sequences like ../../../, the attacker can traverse up the directory structure and target files outside the designated template directory.

The vulnerability enables unauthorized file and directory deletion operations, which could result in:

• Deletion of critical system or application configuration files
• Removal of application data or user files
• Potential denial of service through deletion of essential components

For detailed technical information about this vulnerability, refer to the VulDB entry and the security documentation.

Detection Methods for CVE-2026-2953

Indicators of Compromise

• HTTP requests to WebFileTemplateController.delete endpoints containing path traversal sequences (../, ..\, %2e%2e%2f, or URL-encoded variants)
• Unusual file deletion activity in system logs, particularly outside the template directories
• Web server access logs showing repeated requests to template management endpoints with suspicious path parameters
• File system audit logs indicating deletion of files in unexpected directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in URL parameters and request bodies
• Configure intrusion detection systems (IDS) to alert on HTTP requests with directory traversal signatures targeting UJCMS endpoints
• Enable detailed application logging for the Template Handler component to capture all file operation requests
• Deploy file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications or deletions

Monitoring Recommendations

• Monitor web server access logs for requests to /*/WebFileTemplateController* endpoints containing traversal sequences
• Implement real-time alerting for file deletion events outside the expected template directory paths
• Review authentication logs for accounts accessing template management functions with unusual patterns
• Establish baseline behavior for template management operations and alert on deviations

How to Mitigate CVE-2026-2953

Immediate Actions Required

• Restrict network access to the UJCMS template management interface to trusted IP addresses only
• Implement additional authentication requirements for the Template Handler functionality
• Apply web application firewall rules to block path traversal patterns in requests to the affected endpoints
• Disable or remove the deleteDirectory functionality if not critical to operations until a patch is available
• Review and audit all files that may have been accessed or deleted through this vulnerability

Patch Information

As of the last update on 2026-02-25, no official patch has been released by the vendor. The vendor was contacted early about this disclosure but did not respond. Organizations should monitor the VulDB entry and the official UJCMS repository for patch availability.

In the absence of an official patch, organizations are strongly advised to implement the workarounds and mitigations described below to reduce exposure to this vulnerability.

Workarounds

• Implement a reverse proxy or WAF rule to filter and block requests containing path traversal sequences (../, ..%2f, %2e%2e/, etc.) targeting template management endpoints
• Restrict access to the Template Handler component through network segmentation or access control lists (ACLs)
• Implement file system permissions to limit the web application's ability to delete files outside designated directories
• Consider running the UJCMS application with reduced file system privileges using OS-level access controls

# Example: Nginx WAF-style configuration to block path traversal attempts
location ~* /.*WebFileTemplateController.* {
    # Block common path traversal patterns
    if ($request_uri ~* "\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\.\.%2f") {
        return 403;
    }
    # Restrict access to trusted IPs only
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
}