Read the docs
TI-2026-02754 Aliases CVE-2026-3189GHSA-2p6h-wfw7-47wv

feiyuchuixue sz-boot-parent download server-side request forgery

Priority MEDIUM 45CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 1.3.3-beta is able to resolve this issue. This patch is called aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is advised. The project was informed beforehand and acted very professional: "We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed sz-boot-parent (feiyuchuixue): 1.3.3-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
feiyuchuixuesz-boot-parent1.3.2-beta1.3.3-betaPatch availableCNA
  • sz-boot-parent Vendorfeiyuchuixue Affected 1.3.2-beta Fixed in 1.3.3-beta Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:szadmin:sz-boot-parent:*:*:*:*:*:*:*:*——feiyuchuixue
  • cpe:2.3:a:szadmin:sz-boot-parent:*:*:*:*:*:*:*:* Versions — — ·feiyuchuixue

Remediation

  • Fix · CNA sz-boot-parent (feiyuchuixue) Fixed in 1.3.3-beta

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3189
  2. 2026-10-03 Alias added: GHSA-2p6h-wfw7-47wv

References

Patch 2

Other 2

  • TI-2026-02750 feiyuchuixue sz-boot-parent API Endpoint sys-message authorization CVSS 4.0MEDIUM 6.9
  • TI-2026-02753 feiyuchuixue sz-boot-parent API templates path traversal CVSS 4.0MEDIUM 5.3
  • TI-2026-02752 feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2026-02751 feiyuchuixue sz-boot-parent Password Reset password default password CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences