TI-2026-03427 Aliases CVE-2026-3963 GHSA-6mp3-5629-4c3x

perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key

MEDIUM 61CWE-320Published 2026-03-11 · Updated 2026-03-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/config/ShiroConfig.java of the component Apache Shiro RememberMe. Performing a manipulation results in use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00404 34th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
perfree	go-fastdfs-web	1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7	—	No fix listed	CNA

go-fastdfs-web Vendorperfree Affected 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-3963
2026-10-03 Alias added: GHSA-6mp3-5629-4c3x

References

Exploit 1

https://www.notion.so/go-fastdfs-web-Hardcoded-Apache-Shiro-Cipher-Key-reach-RCE-313ea92a3c41806fae44dffe53e69751

TI-2025-21031 In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload… CVSS 3.1HIGH 8.8
TI-2025-21072 PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. CVSS 3.1HIGH 7.5
TI-2023-21565 An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary… CVSS 3.1HIGH 7.2
TI-2026-09868 perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery CVSS 4.0MEDIUM 6.9
TI-2025-37803 PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function CVSS 3.1HIGH 7.6
TI-2025-37802 PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function CVSS 3.1HIGH 7.6

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences