Executive brief
jishenghua jshERP is an open-source Enterprise Resource Planning (ERP) system used by small and medium-sized businesses for financial and inventory management. A security flaw allows an attacker to manipulate file paths within the system's financial records. If exploited, this could allow an unauthorized user to delete critical system files, potentially leading to a complete service outage or loss of important business data.
Technical details
A stored path traversal vulnerability exists in jshERP-boot up to version 3.6. The vulnerability is rooted in the 'addAccountHeadAndDetail' function within 'AccountHeadService.java', which accepts a 'fileName' parameter via a JSON body without proper sanitization. This malicious string is persisted in the database. When a subsequent 'batchDeleteAccountHeadByIds' operation is triggered, the application retrieves the unsanitized path and passes it to 'SystemConfigService.deleteFileByPathList', which utilizes 'Files.delete()'. A remote attacker with low privileges can use '../' sequences to traverse the file system and delete arbitrary files. As of the advisory date, the vendor has not responded to the issue report.
Affected products
- jishenghua jshERP up to 3.6
Timeline
- 2026-05-19: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: CVE published and NVD entry created