CVE-2026-2665 in base-admin
Summary
by MITRE • 02/18/2026
A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/05/2026
This vulnerability resides within the huanzi-qch base-admin web application framework where the SysFileController.java component contains a critical flaw in its JSP Parser functionality. The specific issue manifests in the Upload function which fails to properly validate file type and content parameters, creating an unrestricted file upload condition that allows malicious actors to bypass normal security controls. The vulnerability is particularly concerning because it operates through the File argument parameter manipulation, enabling arbitrary code execution through crafted file uploads. This represents a classic path traversal and privilege escalation vector that has been classified under CWE-434 Unrestricted Upload of File with Dangerous Type, where the application accepts files without adequate validation or sanitization.
The operational impact of this vulnerability extends beyond simple data compromise as it provides attackers with direct execution capabilities within the application's environment. Remote exploitation is enabled through network-based attacks that can be automated and weaponized using publicly available exploits, making this a high-severity threat that requires immediate remediation. The continuous delivery model with rolling releases employed by this product creates additional complexity in tracking and patching since there are no clear version identifiers to reference for affected or fixed releases, complicating the vulnerability management process. This approach to deployment means that any release could potentially contain the vulnerable code without clear attribution to specific versions.
Security controls surrounding file upload mechanisms have been systematically bypassed through this flaw, allowing attackers to upload malicious files that can execute within the web server context. The absence of proper input validation and content type checking creates pathways for attackers to upload web shells, malware, or other malicious executables that can establish persistent access to the system. From a threat modeling perspective, this vulnerability aligns with attack patterns described in the MITRE ATT&CK framework under T1059 Command and Scripting Interpreter and T1190 Exploit Public-Facing Application, where attackers leverage application vulnerabilities to gain initial access and establish command execution capabilities.
The lack of response from the project maintainers despite early notification through issue reports creates a dangerous precedent for security researchers and organizations relying on open source components. This delayed response pattern increases the risk exposure timeline and demonstrates potential gaps in vulnerability disclosure processes within the project ecosystem. Organizations utilizing this framework should implement immediate compensating controls including network segmentation, web application firewalls, file type validation at multiple layers, and strict access controls to limit potential damage from exploitation. The vulnerability's public exploit availability means that automated scanning tools can quickly identify systems with this flaw, making it a prime target for opportunistic attacks in the current threat landscape.
Mitigation strategies should include immediate code review and implementation of proper file upload validation including content type checking, filename sanitization, and storage location restrictions to prevent execution of uploaded files. Organizations should also implement network-based controls such as web application firewalls with file upload filtering rules, disable unnecessary file upload capabilities where possible, and establish proper monitoring for suspicious file upload activities. The continuous delivery model requires organizations to maintain detailed change tracking and vulnerability scanning processes to identify vulnerable components in their deployments, particularly when upstream projects do not provide clear version information or timely security updates.