CVE-2026-2953 Details

A path traversal vulnerability has been identified in Dromara UJCMS version 101.2, specifically within the Template Handler component. The issue arises in the WebFileTemplateController.delete method, where the deleteDirectory function fails to properly validate certain inputs. Although the application attempts to block standard path traversal sequences, it inadvertently allows empty strings and single forward slashes. This oversight can be exploited to delete all files and subdirectories within the root of the template storage directory, effectively removing the website's templates, styles, and scripts. The vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.