# CVE-2026-86672: ningzichun Student Management System exposed backup file

Source: https://junglewise.ai/threats/cve-2026-86672-ningzichun-student-management-system-exposed-backup-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86672 · Severity: medium · CVSS 5.3 · Published 2026-09-08

The Student Management System, used to manage student records and course enrollments, stores a database backup file (example.7z) in a web-accessible location. An unauthenticated attacker can download this archive to access sensitive student data including personal identity numbers, password hashes, course records, and administrative credentials, enabling privacy violations and potential account takeover.

## Quick answers

**Is CVE-2026-86672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86672 being exploited in the wild.

**How severe is CVE-2026-86672?** Medium severity, with a CVSS score of 5.3, published 8 September 2026.

**Which products and versions are affected?** ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.

**Is there a fix for CVE-2026-86672?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86672 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86672?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw caused by improper access controls on backup files in the Backup Handler component. The unencrypted example.7z archive is stored in the repository root, which is served as the default application document-root, making it retrievable via a simple HTTP GET request without authentication. The archive contains a full SQL export (example.sql) with 997 student records, 997 password hashes, personal identity data (18-digit values), 3,982 course-selection records, and administrative credentials. The attack requires only network access and no authentication; an attacker can directly download the file using standard tools like curl. The project was notified via issue report but has not yet responded or released a patch.

## Affected products

- ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

## Timeline

- 2026-07-29: disclosed: Issue reported on GitHub by ThanatosXingYu
- 2026-09-08: advisory: CVE-2026-86672 published

## References

- [https://github.com/ningzichun/student-management-system/issues/14](https://github.com/ningzichun/student-management-system/issues/14)
- [https://vuldb.com/cve/CVE-2026-86672](https://vuldb.com/cve/CVE-2026-86672)