Read the docs
TI-2026-02752 Aliases CVE-2026-3187GHSA-8p92-v8gg-gvcv

feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload

Priority MEDIUM 57CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-434.

Summary

A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.3.3-beta can resolve this issue. The name of the patch is aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is recommended. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed sz-boot-parent (feiyuchuixue): 1.3.3-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
feiyuchuixuesz-boot-parent1.3.2-beta1.3.3-betaPatch availableCNA
  • sz-boot-parent Vendorfeiyuchuixue Affected 1.3.2-beta Fixed in 1.3.3-beta Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:szadmin:sz-boot-parent:*:*:*:*:*:*:*:*up to 0.9.0Vulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.0.0:beta:*:*:*:*:*:*1.0.0 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.0.1:beta:*:*:*:*:*:*1.0.1 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.0.2:beta:*:*:*:*:*:*1.0.2 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.1.0:beta:*:*:*:*:*:*1.1.0 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.0:beta:*:*:*:*:*:*1.2.0 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.1:beta:*:*:*:*:*:*1.2.1 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.2:beta:*:*:*:*:*:*1.2.2 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.3:beta:*:*:*:*:*:*1.2.3 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.4:beta:*:*:*:*:*:*1.2.4 betaVulnerablefeiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:*:*:*:*:*:*:*:* Versions up to 0.9.0 Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.0.0:beta:*:*:*:*:*:* Versions 1.0.0 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.0.1:beta:*:*:*:*:*:* Versions 1.0.1 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.0.2:beta:*:*:*:*:*:* Versions 1.0.2 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.1.0:beta:*:*:*:*:*:* Versions 1.1.0 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.0:beta:*:*:*:*:*:* Versions 1.2.0 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.1:beta:*:*:*:*:*:* Versions 1.2.1 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.2:beta:*:*:*:*:*:* Versions 1.2.2 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.3:beta:*:*:*:*:*:* Versions 1.2.3 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.4:beta:*:*:*:*:*:* Versions 1.2.4 beta Vulnerable ·feiyuchuixue
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:szadmin:sz-boot-parent:1.2.5:beta:*:*:*:*:*:*1.2.5 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.2.6:beta:*:*:*:*:*:*1.2.6 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.3.0:beta:*:*:*:*:*:*1.3.0 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.3.1:beta:*:*:*:*:*:*1.3.1 betaVulnerablefeiyuchuixue
cpe:2.3:a:szadmin:sz-boot-parent:1.3.2:beta:*:*:*:*:*:*1.3.2 betaVulnerablefeiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.5:beta:*:*:*:*:*:* Versions 1.2.5 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.2.6:beta:*:*:*:*:*:* Versions 1.2.6 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.3.0:beta:*:*:*:*:*:* Versions 1.3.0 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.3.1:beta:*:*:*:*:*:* Versions 1.3.1 beta Vulnerable ·feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:1.3.2:beta:*:*:*:*:*:* Versions 1.3.2 beta Vulnerable ·feiyuchuixue

Remediation

  • Fix · CNA sz-boot-parent (feiyuchuixue) Fixed in 1.3.3-beta

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3187
  2. 2026-10-03 Alias added: GHSA-8p92-v8gg-gvcv

References

Exploit 1

Patch 2

Other 1

  • TI-2026-02750 feiyuchuixue sz-boot-parent API Endpoint sys-message authorization CVSS 4.0MEDIUM 6.9
  • TI-2026-02751 feiyuchuixue sz-boot-parent Password Reset password default password CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences