CVE-2026-11469

Name of the Vulnerable Software and Affected Versions jishenghua jshERP versions prior to 3.7

Description A server-side request forgery (SSRF) exists in the platformConfig Add Endpoint. A remote attacker can manipulate the platformValue argument within the insertPlatformConfig() function of the jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java file to trigger the issue. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the insertPlatformConfig() function to minimize the risk of exploitation.