CVE-2026-96678 is a path traversal vulnerability in the validate function of src/main/java/com/qingwenwei/util/NewUserFormValidator.java within the Avatar Upload component of weiqingwen spring-boot-forum. The flaw arises from improper validation of the Username argument, enabling remote attackers to traverse directories. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are available. The vendor was contacted but did not respond, and no patch or remediation details are provided. The vulnerability has been publicly disclosed and may be exploited.

Successful exploitation can lead to unauthorized file system access via path traversal, potentially allowing attackers to read or write files outside intended directories. The CVSS score of 6.3 reflects low complexity, no user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, restricting access to the vulnerable function and validating inputs more strictly may reduce risk.