CVE-2026-37430: qihang-wms File Upload RCE Vulnerability

CVE-2026-37430 Overview

CVE-2026-37430 is an arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms, a warehouse management system. The flaw affects commit 75c15a and allows remote attackers to execute arbitrary code by uploading a crafted file. The weakness maps to [CWE-434: Unrestricted Upload of File with Dangerous Type]. The application accepts uploaded files without validating their type or content, enabling attackers to place executable payloads on the server.

Critical Impact

Unauthenticated network attackers can upload malicious files to qihang-wms and achieve code execution on the host running the application.

Affected Products

• qihang-wms commit 75c15a
• ShopOrderImportController.java component
• Deployments built from the vulnerable commit

Discovery Timeline

• 2026-05-13 - CVE-2026-37430 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-37430

Vulnerability Analysis

The vulnerability resides in the shop order import handler implemented in ShopOrderImportController.java. The endpoint is designed to accept order data files for bulk import, but it does not enforce restrictions on file extension, MIME type, or content signature. Attackers can submit a request containing a server-side executable payload, such as a JSP or other web shell, instead of a legitimate import document.

Once the file is written to a location served by the application container, the attacker can request it directly. The server then executes the uploaded code in the context of the qihang-wms process. This grants attackers the ability to run commands, read application data, and pivot deeper into the environment. The issue is exploitable over the network without authentication or user interaction.

Root Cause

The root cause is missing server-side validation in the file upload routine. The controller trusts user-supplied filenames and content without enforcing an allowlist of permitted extensions, verifying magic bytes, or storing uploads outside the web-accessible directory. This is a textbook instance of [CWE-434].

Attack Vector

An attacker sends an HTTP POST request to the import endpoint with a crafted multipart payload containing executable code. After the upload succeeds, the attacker issues a follow-up request to the uploaded resource path to trigger execution. No credentials are required, and the attack is remotely reachable.

For implementation specifics, see the public vulnerability writeup and the associated GitHub Gist proof-of-concept notes.

Detection Methods for CVE-2026-37430

Indicators of Compromise

• Unexpected files with executable extensions (.jsp, .jspx, .war, .sh) written under qihang-wms upload directories
• HTTP POST requests to shop order import endpoints with multipart payloads larger or differently shaped than legitimate import files
• Subsequent GET requests to files inside upload directories from external IP addresses

Detection Strategies

• Inspect web server and application logs for POST requests to the import controller followed by GET requests to newly created upload paths
• Hash and baseline contents of the upload directory, alerting on any non-document file types
• Monitor Java process creation for child shells (sh, bash, cmd.exe) spawned by the qihang-wms application

Monitoring Recommendations

• Enable verbose access logging on the qihang-wms reverse proxy and ship logs to a central platform for correlation
• Apply file integrity monitoring to web-accessible directories used for imports
• Alert on outbound network connections originating from the qihang-wms host to untrusted destinations, which often indicate post-exploitation activity

How to Mitigate CVE-2026-37430

Immediate Actions Required

• Restrict network access to the qihang-wms import endpoint to trusted internal IP ranges until a patched build is deployed
• Require authentication and authorization on the ShopOrderImportController route at the reverse proxy or WAF layer
• Audit the upload directory for files written since the application was deployed and remove any unexpected executable content

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2026-37430. Operators running builds based on commit 75c15a should track the upstream qihang-wms repository for a fixed commit and rebuild from a vetted source once available.

Workarounds

• Configure the application server to deny execution of scripts within upload directories, for example by disabling JSP handling for that path
• Add a WAF rule that rejects multipart uploads to the import endpoint when the filename extension is not in an allowlist such as .csv, .xls, or .xlsx
• Run qihang-wms under a low-privilege service account so that successful exploitation does not yield administrative access

# Example nginx snippet to block executable uploads from being served
location ~* ^/upload/.*\.(jsp|jspx|war|sh|php)$ {
    deny all;
    return 403;
}