CVE-2026-1549 is a path traversal vulnerability affecting jishenghua's jshERP product versions 3.0 through 3.6. The vulnerability resides in the PluginController component, specifically in the /jshERP-boot/plugin/uploadPluginConfigFile endpoint. An attacker can manipulate the configFile parameter to perform directory traversal, allowing access to files outside the intended directory scope. This can lead to unauthorized disclosure of sensitive files on the server, potentially including configuration files, credentials, or other critical data. The vulnerability is remotely exploitable without requiring authentication or user interaction, increasing its risk profile. The CVSS 4.0 score is 5.3 (medium), reflecting the moderate impact on confidentiality and ease of exploitation. Although no patches or vendor responses are currently available, a public exploit exists, which could facilitate attacks if leveraged by threat actors. The vulnerability does not affect integrity or availability directly but compromises confidentiality by exposing sensitive data. The lack of vendor response and patch availability increases the urgency for affected organizations to implement compensating controls.

For European organizations using jshERP versions up to 3.6, this vulnerability could lead to unauthorized disclosure of sensitive internal files, including potentially critical configuration or credential files. This exposure could facilitate further attacks such as privilege escalation, lateral movement, or data exfiltration. The remote and unauthenticated nature of the exploit increases the risk of opportunistic attacks, especially in environments where jshERP is internet-facing or insufficiently segmented. Confidentiality breaches could impact compliance with GDPR and other data protection regulations, leading to legal and reputational consequences. The lack of vendor patches means organizations must rely on mitigations to reduce risk. Industries with high reliance on ERP systems, such as manufacturing, logistics, and retail, could face operational disruptions if sensitive business data is exposed or manipulated indirectly through subsequent attacks.

1. Immediately restrict external access to the /jshERP-boot/plugin/uploadPluginConfigFile endpoint via network controls such as firewalls or web application firewalls (WAFs). 2. Implement strict input validation and sanitization on the configFile parameter to prevent directory traversal sequences (e.g., ../). 3. Employ file system permissions to ensure the jshERP process has minimal access rights, limiting exposure if traversal occurs. 4. Monitor logs for unusual access patterns or attempts to exploit the path traversal vulnerability. 5. If possible, isolate jshERP instances in segmented network zones to reduce exposure. 6. Engage with the vendor or community for updates or unofficial patches and test any available fixes in a controlled environment before deployment. 7. Consider deploying runtime application self-protection (RASP) tools that can detect and block path traversal attempts dynamically. 8. Conduct regular security assessments and penetration tests focusing on this vulnerability vector until an official patch is released.