CVE-2026-11467

Name of the Vulnerable Software and Affected Versions jishenghua jshERP versions prior to 3.7

Description A path traversal issue exists in the 'addAccountHeadAndDetail' endpoint. This occurs within the addAccountHeadAndDetail() function located in the jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java file. A remote attacker can manipulate the fileName argument to access files and directories outside the intended folder. Path traversal is a technique that allows an attacker to read arbitrary files on the server by manipulating file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the 'addAccountHeadAndDetail' endpoint or avoid using the fileName parameter until a patch is available.