Log in Start free

Vulnerability · Published Jun 8, 2026 · Assigned by VulDB

CVE-2026-11470hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal

Medium 6.3

In plain English

A medium-severity path traversal in hsweb-framework from hs-web. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in hs-web hsweb-framework up to 5.0.1. The affected element is the function denied of the file hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java of the component File Upload. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8009845b577d8a2c4bbf4fdd8e8913799a714be6. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.hswebframework.web:hsweb-system-fileno fix listedGHSA-vjmr-f5fc-vr2w

Affected products (as reported)

VendorProductVersions
hs-web hsweb-framework 5.0.05.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References