CVE-2026-2953 identifies a path traversal vulnerability in Dromara UJCMS version 101.2, affecting the deleteDirectory function within the WebFileTemplateController.delete component, which is part of the Template Handler module. The vulnerability arises from insufficient validation or sanitization of file path inputs, allowing an attacker to manipulate the path parameter to traverse directories outside the intended scope. This can lead to unauthorized deletion or access of files on the server's filesystem. The attack vector is remote network access, and exploitation requires limited privileges but no user interaction or authentication. The vulnerability impacts the confidentiality, integrity, and availability of the system by enabling unauthorized file system operations. The vendor was notified but has not issued a patch or response, and public exploit details have been disclosed, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:L, meaning limited privileges), no user interaction (UI:N), and partial impacts on confidentiality, integrity, and availability (each marked as low). No known exploits in the wild have been reported yet. The lack of vendor response and patch availability necessitates immediate mitigation by users of UJCMS 101.2.

The vulnerability allows attackers with limited privileges to perform unauthorized file system operations, including deleting or accessing files outside the intended directory structure. This can lead to data loss, unauthorized disclosure of sensitive information, or disruption of service availability. Organizations relying on Dromara UJCMS 101.2 for content management may face compromised system integrity and availability, potentially affecting website functionality and data security. The public disclosure of exploit details increases the likelihood of exploitation attempts, especially in environments where the CMS is exposed to the internet. The impact is heightened in sectors where data confidentiality and service continuity are critical, such as government, finance, and healthcare. Additionally, the absence of vendor patches prolongs exposure and risk.

1. Immediately restrict access to the affected deleteDirectory functionality by implementing strict access controls and limiting user privileges to only trusted administrators. 2. Employ web application firewalls (WAFs) with custom rules to detect and block path traversal patterns targeting the deleteDirectory endpoint. 3. Conduct input validation and sanitization at the application level to reject suspicious path parameters, especially those containing directory traversal sequences like '../'. 4. Isolate the CMS environment using containerization or sandboxing to limit the impact of potential exploitation. 5. Regularly back up critical data and configuration files to enable recovery in case of unauthorized deletions. 6. Monitor logs for unusual file system access or deletion activities related to the Template Handler component. 7. Engage with the vendor or community to track patch releases or official mitigations. 8. Consider upgrading to a newer, unaffected version of UJCMS once available or applying community-developed patches if official fixes remain unavailable.