# CVE-2026-8320: jishenghua jshERP SSRF in updatePlatformConfigByKey

Source: https://junglewise.ai/threats/cve-2026-8320-jishenghua-jsherp-ssrf-in-updateplatformconfigbykey  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-8320 · Severity: medium · CVSS 4.7 · Published 2026-05-11

jishenghua jshERP is an open-source Enterprise Resource Planning (ERP) system used by small and medium-sized businesses for inventory and financial management. A security vulnerability allows an administrative user to redirect the application's internal web requests to unintended destinations. This could be used to scan internal corporate networks, access sensitive cloud metadata, or intercept WeChat integration credentials, potentially leading to broader network compromise or data theft.

Technologies: [Jishenghua jshERP](https://junglewise.ai/threats/technologies/jsherp). Vendors: [Jishenghua](https://junglewise.ai/threats/vendors/jishenghua).

## Quick answers

**Is CVE-2026-8320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8320 being exploited in the wild.

**How severe is CVE-2026-8320?** Medium severity, with a CVSS score of 4.7, published 11 May 2026.

**Which products and versions are affected?** Jishenghua jshERP up to 3.6.

**Is there a fix for CVE-2026-8320?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8320 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8320?** Check whether you run Jishenghua jshERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in jshERP up to version 3.6 within the WeChat integration logic. The root cause is a lack of validation in the `updatePlatformConfigByKey` endpoint in `PlatformConfigController.java`, which allows an authenticated administrator to modify the `weixinUrl` parameter in the database to any arbitrary URL. This malicious URL is subsequently retrieved and used by the `getUserByWeixinCode` function in `UserService.java` to perform an HTTP GET request via `HttpClient.httpGet`. An attacker with administrative privileges can exploit this to perform internal network scanning, access cloud instance metadata (e.g., AWS 169.254.169.254), or exfiltrate WeChat AppID and AppSecret credentials. As of the advisory date, the project has not responded to the issue report.

## Affected products

- jishenghua jshERP up to 3.6

## Timeline

- 2026-05-11: advisory: CVE-2026-8320 published via VulDB/NVD
- 2026-05-11: disclosed: Public disclosure of the exploit and vulnerability details on GitHub issues

## References

- [https://github.com/jishenghua/jshERP/](https://github.com/jishenghua/jshERP/)
- [https://github.com/jishenghua/jshERP/issues/152](https://github.com/jishenghua/jshERP/issues/152)
- [https://vuldb.com/submit/811303](https://vuldb.com/submit/811303)
- [https://vuldb.com/vuln/362607](https://vuldb.com/vuln/362607)
- [https://vuldb.com/vuln/362607/cti](https://vuldb.com/vuln/362607/cti)

## Related threats

- [jshERP mass assignment vulnerability in UserController](https://junglewise.ai/threats/cve-2026-109186-jsherp-through-3-6-contains-a-mass-assignment-vulnerability-in)
- [jshERP improper authorization in accounting endpoints](https://junglewise.ai/threats/cve-2026-109184-jsherp-through-3-6-contains-an-improper-authorization)
- [jshERP authorization bypass in bill creation](https://junglewise.ai/threats/cve-2026-109183-jsherp-through-3-6-contains-an-authorization-bypass)
- [jshERP authorization bypass in supplier export](https://junglewise.ai/threats/cve-2026-109182-jsherp-through-3-6-contains-an-incorrect-authorization)
- [jshERP missing authorization in LogController](https://junglewise.ai/threats/cve-2026-109179-jsherp-through-3-6-contains-a-missing-authorization)