{"id":"CVE-2026-3187","summary":"feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload","details":"A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.3.3-beta can resolve this issue. The name of the patch is aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is recommended. The project was informed beforehand and acted very professional: \"We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads.\"","modified":"2026-08-12T15:32:19.366062Z","published":"2026-02-25T14:32:09.116Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-284","CWE-434"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3187.json"},"references":[{"type":"WEB","url":"https://github.com/feiyuchuixue/sz-boot-parent/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3187.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3187"},{"type":"ADVISORY","url":"https://vuldb.com/?id.347745"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.754038"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.347745"},{"type":"FIX","url":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802"},{"type":"FIX","url":"https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta"},{"type":"EVIDENCE","url":"https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Arbitrary_File_Upload.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/feiyuchuixue/sz-boot-parent","events":[{"introduced":"0"},{"last_affected":"9ee01d24252d86a1844dbbf9fb448879e1d4a971"},{"introduced":"0de7f8a850826bff23d74dc3e7fd52d6cec945f8"},{"fixed":"aefaabfd7527188bfba3c8c9eee17c316d094802"},{"fixed":"aa006068f35ea29944af1a4f7112c9cced57a10c"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:szadmin:sz-boot-parent:*:*:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.0.0:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.0.1:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.0.2:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.1.0:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.0:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.1:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.2:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.3:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.4:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.5:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.2.6:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.3.0:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.3.1:beta:*:*:*:*:*:*","cpe:2.3:a:szadmin:sz-boot-parent:1.3.2:beta:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"0.9.0"},{"introduced":"1.0.0-beta"},{"last_affected":"1.0.0-beta"},{"introduced":"1.0.1-beta"},{"last_affected":"1.0.1-beta"},{"introduced":"1.0.2-beta"},{"last_affected":"1.0.2-beta"},{"introduced":"1.1.0-beta"},{"last_affected":"1.1.0-beta"},{"introduced":"1.2.0-beta"},{"last_affected":"1.2.0-beta"},{"introduced":"1.2.1-beta"},{"last_affected":"1.2.1-beta"},{"introduced":"1.2.2-beta"},{"last_affected":"1.2.2-beta"},{"introduced":"1.2.3-beta"},{"last_affected":"1.2.3-beta"},{"introduced":"1.2.4-beta"},{"last_affected":"1.2.4-beta"},{"introduced":"1.2.5-beta"},{"last_affected":"1.2.5-beta"},{"introduced":"1.2.6-beta"},{"last_affected":"1.2.6-beta"},{"introduced":"1.3.0-beta"},{"last_affected":"1.3.0-beta"},{"introduced":"1.3.1-beta"},{"last_affected":"1.3.1-beta"},{"introduced":"1.3.2-beta"},{"last_affected":"1.3.2-beta"}]}}],"versions":["1.0.0-beta","1.0.1-beta","1.0.2-beta","1.1.0-beta","1.2.0-beta","1.2.1-beta","1.2.2-beta","1.2.3-beta","1.2.4-beta","1.2.5-beta","1.2.6-beta","1.3.0-beta","1.3.1-beta","1.3.2-beta","v1.3.2-beta","v1.3.1-beta","v1.3.0-beta","v1.2.6-beta","v1.2.5-beta","v1.2.4-beta","v1.2.3-beta","v1.2.2-beta","v1.2.1-beta","v1.2.0-beta","v1.1.0-beta","v1.0.1-beta","v1.0.0-beta","v0.9.0","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-service/sz-service-admin/src/main/java/com/sz/admin/system/service/impl/CommonServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["323699978759532718635517452930014157374","278512815284875105518285646130543054351","36593422020877463883026974281695531237","272061730393614553358149570337127224283","53103655436858705070311452962028882628","44075739219662578324712019844678751771","327294547989315988770463799345714587219","239202637047055361717084429664878585266","286830467102291430063201447598526686506","278046516090588714991238521370842759171","458335260742716500581542517133734864","216810359571802661167438494342302831140","323131193342097975444505137381207414144","94591104986195072435463028310334849886","301282123361441700893620100181908019869"]},"id":"CVE-2026-3187-03a875f0"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-common/sz-common-oss/src/main/java/com/sz/oss/OssClient.java","function":"upload"},"deprecated":false,"digest":{"function_hash":"91968328190997309201035462725446067993","length":1084},"id":"CVE-2026-3187-1a1f17cb"},{"deprecated":false,"digest":{"function_hash":"148515232992734810439385593609049960115","length":1350},"id":"CVE-2026-3187-6dbb5e1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-service/sz-service-admin/src/main/java/com/sz/admin/system/service/impl/CommonServiceImpl.java","function":"tempDownload"}},{"id":"CVE-2026-3187-7b4f6945","signature_type":"Function","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"function":"uploadFile","file":"sz-service/sz-service-admin/src/main/java/com/sz/admin/system/service/impl/SysFileServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"308803253615992416229235436819114806219","length":468}},{"signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-common/sz-common-core/src/main/java/com/sz/core/common/enums/CommonResponseEnum.java"},"deprecated":false,"digest":{"line_hashes":["277942120457754224802171963001660316056","88837087369728294789047350726325442175","235235260745382181237867899821030565974","15742790080606154877780864469318451144","231192593096753076971379037027650252815","283608100241087537028963326420930173127","305846107919889889682150550143677653953","313352502671975385882582273382790166756"],"threshold":0.9},"id":"CVE-2026-3187-863be5ed","signature_type":"Line"},{"id":"CVE-2026-3187-99ab2139","signature_type":"Function","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-service/sz-service-admin/src/main/java/com/sz/admin/system/service/impl/CommonServiceImpl.java","function":"urlDownload"},"deprecated":false,"digest":{"function_hash":"225278081170458871218076099460204604216","length":611}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-common/sz-common-oss/src/main/java/com/sz/oss/OssClient.java"},"deprecated":false,"digest":{"line_hashes":["103138851156029986833163544553542688400","109618906410909670291605387106640317792","60778242656958474165163829742022739704","196975535504903561188456788947563278753","240200906823074802306116717207224145263","337650335776309080559168071809135516213","140067407883095246107825187588006492025","42294433730485082846360042258796992520","239791871285488964924840426468120753147","180561142787809721723887880360824244471","291039854275591684202010979994120181055","30839313325673629537549220149649326349","77685321241126713991814648024566266221"],"threshold":0.9},"id":"CVE-2026-3187-b0bec15b"},{"target":{"file":"sz-service/sz-service-admin/src/main/java/com/sz/admin/system/service/impl/SysFileServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["219440635577386967702728018467494114535","274713120834129023108041582438663570771","332555259173332961810998646747950140923","116274267578782298374217174753197197545","83214300295503441277927501406928722994","245551531657935898725553262143855049599","303812482602061557159547400622892344696","243015244187948900821873619343399406478","36155483903363266227726369675222470404","302677085514228203606156016271870625560","79729122850387585055962612807087702634","280436730576346234974564080073639337604","296284648725456880477082201465509265358","338572306453143723672042702560475775543","15337108793607785757019877705392563981","78418422176974080163608964182484926822","290008086871022100423469916381280328026","227412099732104436736556730522483151363","32384376755146565297952128543851637210","247367233454898545863512972355923508535","288935083785579605236106196027180320286","159159567493344269134286897692888767198"]},"id":"CVE-2026-3187-d3a4ab97","signature_type":"Line","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802"},{"id":"CVE-2026-3187-f2e197dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-common/sz-common-core/src/main/java/com/sz/core/util/Utils.java"},"deprecated":false,"digest":{"line_hashes":["247997219865391784818402276383106638516","82476260474160191190619696386489110591"],"threshold":0.9}},{"source":"https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802","target":{"file":"sz-common/sz-common-oss/src/main/java/com/sz/oss/OssProperties.java"},"deprecated":false,"digest":{"line_hashes":["37567395144001211202463691524831225894","165548830934288695250151783318675438571","151277052329436100383129648884142921812","258731638997879764379183999121629997132"],"threshold":0.9},"id":"CVE-2026-3187-f8c5b70a","signature_type":"Line","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3187.json","vanir_signatures_modified":"2026-08-12T15:32:19Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}