CVE-2026-2863 Details
Description
A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function deleteFile of the file FileServiceImpl.java. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability allowing arbitrary file deletion has been identified in the production_ssm system, part of the feng_ha_ha/megagao SSM-ERP project. This issue affects versions of production_ssm prior to the commit 4288d53bd35757b27f2d070057aefb2c07bdd097. The vulnerability arises in the deleteFile function within FileServiceImpl.java, where the application fails to properly sanitize file path inputs. This oversight enables remote attackers to manipulate file paths using directory traversal sequences to delete files outside of the intended directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 21, 2026CISA-ADP
Assessed Feb 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/megagao/production_ssm/issues/37 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/megagao/production_ssm/issues/37#issue-3914979380 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.347102 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.347102 | [email protected] | AdvisoryExploitTechnical Description |
| https://vuldb.com/?submit.754530 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| feng_ha_ha/megagao ssm-erp | All versions |
CPE
Remediation
| |
| feng_ha_ha/production_ssm | <= 4288d53bd35757b27f2d070057aefb2c07bdd097 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |