CVE-2026-7519 Overview
CVE-2026-7519 is a path traversal vulnerability [CWE-22] affecting Fujian Apex LiveBOS up to version 2.0. The flaw resides in an unknown function within the /feed/UploadImage.do endpoint of the Endpoint component. Attackers can manipulate the filename argument to traverse the file system outside the intended upload directory.
The vulnerability is exploitable remotely without authentication or user interaction. Public disclosure of the exploit technique increases the likelihood of opportunistic scanning and abuse. Fujian Apex has addressed the issue in LiveBOS version 2.1, and administrators should upgrade the affected component.
Critical Impact
Unauthenticated remote attackers can traverse directories through the filename parameter in /feed/UploadImage.do, enabling unauthorized file access or write operations on affected LiveBOS deployments.
Affected Products
- Fujian Apex LiveBOS versions up to and including 2.0
- Endpoint component handling /feed/UploadImage.do
- Deployments not yet upgraded to LiveBOS 2.1
Discovery Timeline
- 2026-05-01 - CVE-2026-7519 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-7519
Vulnerability Analysis
The vulnerability is a path traversal weakness classified under [CWE-22]. The /feed/UploadImage.do handler in the Endpoint component accepts a filename parameter without normalizing or validating directory separator sequences. Attackers can supply traversal sequences such as ../ to reference paths outside the intended upload directory.
Because the endpoint is reachable over the network and requires no authentication, exploitation can be performed by any remote actor that can reach the application. The disclosed exploit lowers the barrier for adversaries to weaponize the issue against exposed instances.
Successful exploitation can lead to unauthorized reading or writing of files within the application's runtime context. Depending on the file system permissions of the LiveBOS process, attackers may access configuration data, session artifacts, or place files in locations that influence subsequent request handling.
Root Cause
The root cause is insufficient input validation on the filename parameter passed to /feed/UploadImage.do. The handler does not canonicalize the path or restrict it to an allowlisted upload directory before performing file operations. As a result, traversal sequences are honored by the underlying file API.
Attack Vector
The attack vector is network-based. An attacker issues a crafted HTTP request to /feed/UploadImage.do with a filename value containing relative path components. No credentials, tokens, or user interaction are required, and the request can be issued by automated scanners. See the VulDB entry for CVE-2026-7519 for additional context.
No verified exploit code is reproduced here. Refer to the VulDB CTI record and the public disclosure document for technical details on the disclosed proof of concept.
Detection Methods for CVE-2026-7519
Indicators of Compromise
- HTTP requests to /feed/UploadImage.do containing ../, ..%2f, or encoded traversal sequences in the filename parameter.
- Unexpected file creation or modification outside the LiveBOS upload directory.
- Web server access logs showing repeated POST requests to /feed/UploadImage.do from a single source within a short window.
Detection Strategies
- Inspect web access logs for path traversal patterns targeting the filename query string or form field on /feed/UploadImage.do.
- Deploy WAF or reverse proxy rules that decode and normalize request parameters before evaluation, blocking traversal sequences.
- Monitor file integrity on directories adjacent to the LiveBOS upload path for writes originating from the application service account.
Monitoring Recommendations
- Forward LiveBOS application and web server logs to a centralized SIEM for correlation against traversal signatures.
- Alert on HTTP 200 responses to /feed/UploadImage.do requests carrying suspicious filename values.
- Track outbound connections and process executions originating from the LiveBOS service account to identify follow-on activity after a successful traversal.
How to Mitigate CVE-2026-7519
Immediate Actions Required
- Upgrade Fujian Apex LiveBOS to version 2.1 or later, which addresses the path traversal flaw.
- Restrict network access to /feed/UploadImage.do to trusted sources until the upgrade is applied.
- Audit the LiveBOS upload directory and adjacent paths for unauthorized files written prior to remediation.
Patch Information
Fujian Apex has released LiveBOS 2.1 to address CVE-2026-7519. Administrators should plan and execute the upgrade per vendor guidance. Validate the patched version through the application's version metadata after deployment, and confirm that the /feed/UploadImage.do handler rejects traversal sequences in the filename parameter.
Workarounds
- Place a WAF rule in front of LiveBOS that denies requests to /feed/UploadImage.do containing .., URL-encoded traversal tokens, or absolute paths in the filename parameter.
- Run the LiveBOS service under a least-privilege account with no write access outside its required directories.
- Block external access to the LiveBOS administrative interfaces at the network perimeter, exposing only required endpoints to authenticated users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
