CVE-2026-3187 - Vulnerability Analysis

Overview

feiyuchuixue sz-boot-parent <= 1.3.2-beta contains an unrestricted file upload vulnerability caused by lack of proper file type restrictions in /api/admin/sys-file/upload API endpoint, letting remote attackers upload arbitrary files, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can upload arbitrary files, potentially leading to remote code execution or system compromise.

Mitigation

Upgrade to version 1.3.3-beta or later.

References

• https://github.com/feiyuchuixue/sz-boot-parent/
• https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802
• https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta
• https://github.com/yuccun/CVE/blob/main/sz-boot-parent-Arbitrary_File_Upload.md
• https://vuldb.com/?ctiid.347745
• https://vuldb.com/?id.347745
• https://vuldb.com/?submit.754038

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner