CVE-2026-96678

Name of the Vulnerable Software and Affected Versions weiqingwen spring-boot-forum versions up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f

Description A path traversal issue exists in the Avatar Upload component. A remote attacker can exploit this by manipulating the Username argument within the validate() function of the src/main/java/com/qingwenwei/util/NewUserFormValidator.java file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations As a temporary workaround, restrict the use of the Username argument in the validate() function of the src/main/java/com/qingwenwei/util/NewUserFormValidator.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.