CVE-2026-86672: Student Management System Info Disclosure

CVE-2026-86672 Overview

CVE-2026-86672 is an information disclosure vulnerability in the ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The flaw resides in an unspecified function of the example.7z file within the Backup Handler component. An unauthenticated remote attacker can retrieve sensitive information by accessing the exposed backup archive over the network. The exploit has been publicly disclosed and may be reused by opportunistic attackers. The project uses continuous delivery with rolling releases, so no fixed or affected version numbers are published. Maintainers were notified through a GitHub issue but have not yet responded, leaving deployments exposed. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A publicly reachable backup archive allows unauthenticated remote attackers to obtain sensitive data from Student Management System deployments without any user interaction.

Affected Products

ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
Backup Handler component (example.7z file)
All rolling-release deployments that expose the backup file over HTTP

Discovery Timeline

2026-09-08 - CVE-2026-86672 published to NVD
2026-09-08 - Last updated in NVD database
Vendor status - Project informed via GitHub Issue #14 but has not responded

Technical Details for CVE-2026-86672

Vulnerability Analysis

The Student Management System ships or generates a backup archive named example.7z that is reachable through the application's web root. Because the Backup Handler stores this file in a location served by the HTTP layer without access controls, any remote client can request the archive directly. The archive contains application data intended for administrative use only, which enables information disclosure to unauthenticated attackers.

The issue is classified under CWE-200, reflecting exposure of sensitive information to an unauthorized actor. The rolling-release model means administrators cannot rely on a version bump to confirm remediation and must verify the file's presence and permissions directly. Public disclosure through VulDB entry 399762 increases the likelihood of automated scanning for the file path.

Root Cause

The root cause is an insecure default configuration in the Backup Handler. The component writes or stores a backup archive at a predictable location within the served application directory. No authentication, authorization, or path-based access restriction is applied before the web server returns the file to a requester.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to the known path of example.7z on a vulnerable host. The web server returns the archive, which the attacker then extracts offline to inspect student records, credentials, or other application data contained in the backup. No privileges or user interaction are required. Full technical context is available in the VulDB CVE-2026-86672 entry and the GitHub issue report.

Detection Methods for CVE-2026-86672

Indicators of Compromise

HTTP GET requests to example.7z or similar archive paths within the application's web root
Web server access logs showing successful 200 responses for .7z, .zip, or .tar.gz files served from public directories
Outbound transfers of large archive files from the web host to unfamiliar client IP addresses
Repeated scanning patterns hitting backup-related filenames such as backup, dump, or example

Detection Strategies

Inspect web server logs for direct requests to backup archive extensions and correlate against expected administrative source IPs
Deploy web application firewall (WAF) rules that block or alert on requests targeting archive file extensions in application directories
Perform authenticated content discovery scans against production hosts to enumerate exposed backup files
Compare deployed file trees against source repositories to identify sample or leftover artifacts such as example.7z

Monitoring Recommendations

Alert on any external HTTP request that successfully retrieves a file with an archive extension from the Student Management System host
Track file integrity of the application's web-served directories to detect newly created backup artifacts
Monitor egress bandwidth spikes from the web application server that could indicate archive exfiltration

How to Mitigate CVE-2026-86672

Immediate Actions Required

Remove example.7z and any other backup archives from directories served by the web server
Restrict web server access to backup file extensions such as .7z, .zip, .tar, .gz, and .bak
Audit the deployment for other sample or demonstration files shipped alongside the application source
Rotate any credentials, tokens, or student data that may have been exposed if log review indicates prior access

Patch Information

No vendor patch is currently available. The project was notified through GitHub Issue #14 but has not responded. Because the project uses rolling releases, administrators must apply configuration-level mitigations rather than waiting for a versioned fix. Track the VulDB entry for updates.

Workarounds

Delete example.7z from the application directory and rebuild backups outside of any web-accessible path
Configure the web server to deny requests for archive file extensions using explicit location or Files directives
Place the application behind an authentication proxy or restrict administrative paths to trusted source networks
Store all backups on a separate host or object storage location that is not exposed by the application's HTTP listener

bash

# Nginx example: block archive extensions from being served
location ~* \.(7z|zip|tar|gz|bak|sql|dump)$ {
    deny all;
    return 404;
}

# Apache example: block archive extensions via .htaccess
<FilesMatch "\.(7z|zip|tar|gz|bak|sql|dump)$">
    Require all denied
</FilesMatch>