CVE-2026-1061

Name of the Vulnerable Software and Affected Versions xiweicheng TMS versions prior to 2.28.0

Description An issue exists in xiweicheng TMS that allows for unrestricted file uploads. This is due to the manipulation of the filename argument within the Upload function located in the file src/main/java/com/lhjz/portal/controller/FileController.java. The attack can be initiated remotely. The exploit is publicly available.

Recommendations Update to a version later than 2.28.0. As a temporary workaround, restrict access to the Upload function in src/main/java/com/lhjz/portal/controller/FileController.java.