CVE-2026-8320

Name of the Vulnerable Software and Affected Versions jishenghua jshERP versions prior to 3.7

Description A server-side request forgery (SSRF) exists in the updatePlatformConfigByKey endpoint. This occurs when the weixinUrl argument is manipulated within the getUserByWeixinCode() function located in the jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java file. This flaw allows a remote attacker to induce the server to make unauthorized requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the updatePlatformConfigByKey endpoint or avoid using the weixinUrl parameter.