CVE-2021-46062

Name of the Vulnerable Software and Affected Versions Mingfei Content Management System (MCMS) versions prior to 5.2.11 net.mingsoft:ms-basic versions prior to 2.1.16

Description The issue allows for arbitrary file deletion. This can be achieved via the oldFileName parameter in POST requests to the "/template/writeFileContent" API endpoint.

Recommendations For net.mingsoft:ms-basic versions prior to 2.1.16, update to version 2.1.16 or later. For MCMS versions prior to 5.2.11, update to version 5.2.11 or later. As a temporary workaround, consider restricting access to the "/template/writeFileContent" API endpoint to minimize the risk of exploitation. Avoid using the oldFileName parameter in the affected API endpoint until the issue is resolved.