Vulnerability · Published Apr 17, 2026 · Assigned by VulDB

CVE-2026-6487Qihui jtbc5 CMS Code Endpoint manage.php path traversal

Medium 4.3

In plain English

A medium-severity path traversal in jtbc5 CMS from Qihui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 69.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/manage.php of the component Code Endpoint. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Qihui	jtbc5 CMS	5.0.3.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-358028 | Qihui jtbc5 CMS Code Endpoint manage.php path traversal vdb-entry, technical-description
VDB-358028 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #786183 | Shanghai Qihui Network Technology Co., Ltd. jtbc5 CMS v5.0.3.6 Directory Traversal third-party-advisory
https://tcn60zf28jhk.feishu.cn/wiki/CnpvwDdyOi5PXOk8X1fcorudnSv?from=from_copylink exploit