feiyuchuixue sz-boot-parent up to 1.3.2-beta API Endpoint upload unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This affects an unknown part of the file /api/admin/sys-file/upload of the component API Endpoint. Performing a manipulation results in unrestricted upload. This vulnerability is known as CVE-2026-3187. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is recommended to upgrade the affected component. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."

Detailsinfo

A vulnerability, which was classified as critical, was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This affects some unknown processing of the file /api/admin/sys-file/upload of the component API Endpoint. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-3187. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."

Upgrading to version 1.3.3-beta eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch aefaabfd7527188bfba3c8c9eee17c316d094802 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• feiyuchuixue

Name

• sz-boot-parent

Version

• 1.3.2-beta

License

• open-source

Website

• Product: https://github.com/feiyuchuixue/sz-boot-parent/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #754038: feiyuchuixue https://github.com/feiyuchuixue/sz-boot-parent sz-boot-parent <= v1.3.2-beta Arbitrary File Upload (by yuccun)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion