CVE-2026-11467 is a path traversal vulnerability affecting jishenghua jshERP up to version 3.6. It occurs in the addAccountHeadAndDetail function within the AccountHeadService.java file, where improper validation of the fileName argument allows remote attackers to traverse directories and potentially access sensitive files. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. Despite early notification to the vendor, no official fix or remediation has been released as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server running jshERP, potentially exposing sensitive information. The vulnerability is remotely exploitable and does not require user interaction, increasing the risk of unauthorized data disclosure. However, the attack requires low privileges and the overall severity is rated medium (CVSS 5.3). No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as restricting access to the vulnerable endpoint, validating and sanitizing input parameters at the application or web server level, and monitoring for suspicious activity related to file access. Stay alert for any future vendor advisories or patches addressing this issue.