PT-2026-36672

CVE-2026-7673

Published

2026-05-03

Updated

2026-05-03

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions crmeb java versions prior to 1.3.5

Description An unrestricted file upload issue exists within the Admin Upload component, specifically affecting the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java. Manipulation of the model argument allows for remote exploitation, enabling an attacker to upload files without proper restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Xcxr

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers