CVE-2026-2864 Details
Description
A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in the 'production_ssm' system, specifically within the 'pictureDelete' function of 'PictureController.java'. This issue affects versions of the software prior to the commit 4288d53bd35757b27f2d070057aefb2c07bdd097. The vulnerability arises because the system fails to properly sanitize directory traversal characters in file path inputs, allowing remote attackers to manipulate the 'picName' parameter and delete arbitrary files. The vulnerability has been publicly disclosed and is exploitable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 21, 2026CISA-ADP
Assessed Feb 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/megagao/production_ssm/issues/38 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/megagao/production_ssm/issues/38#issue-3915113401 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.347103 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.347103 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.754557 | [email protected] | ExploitIssue TrackingTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| feng_ha_ha/megagao ssm-erp | All versions |
CPE
Remediation
| |
| feng_ha_ha/production_ssm | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |