CVE-2026-96678

MediumCVSS 6.3/10Last modified Sep 29, 2026

Description

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-96686.3With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitr CVE-2026-966804.3A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.CVE-2026-966827.2The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versi CVE-2026-96698.2bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the CVE-2026-96736.8Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which ca CVE-2026-967394.3A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the CVE-2026-96744.3A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume fail CVE-2026-967406.5A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are co CVE-2026-967436.4The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versio CVE-2026-967447.1Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can CVE-2026-967455.6Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document con CVE-2026-967466.5An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resol