Executive brief
Oinone Pamirs is a low-code development framework used to build enterprise applications. A security flaw in its file upload component allows an attacker to bypass security controls and save files to unauthorized locations on the server. This could lead to a complete system takeover if an attacker overwrites critical system configuration files or scheduled tasks.
Technical details
A path traversal vulnerability exists in the `RestController` component of Oinone Pamirs, specifically within `LocalFileClient.java`. The application processes the `uniqueFileName` parameter via `request.getParameter` without proper sanitization or normalization. By injecting directory traversal sequences (e.g., `../`), an attacker can escape the intended storage directory. Although some metrics suggest physical access, the technical PoC demonstrates a remote network-based POST request to `/file/upload` that bypasses the GraphQL permission gateway. This can be exploited to overwrite sensitive files like `/etc/cron.d/` to achieve remote code execution. No official patch has been confirmed by the vendor.
Affected products
- Oinone (Zhejiang Shushi Network Technology) Pamirs (AI Low-Code Development Framework) up to 7.2.0
Timeline
- 2026-04-22: disclosed: Initial public disclosure on GitHub by SourByte05
- 2026-05-17: advisory: CVE-2026-8736 published via VulDB/NVD